有些用户上传了保密合同/协议文件,这些文件存储在/var/www/html/project/public/contract/<HERE_UNIQUE_FILES.pdf>
目录中。
但问题是来自谷歌搜索或直接链接,任何未经授权的用户都可以打开它并查看/复制它。
我如何保护它,以便只有我的域或允许的对等体才能访问此私人目录?
示例:
class Application_Model_Uploader
{
public static function mvUploadContract()
{
/* Anyone from outside can access this path, but how to protect it? */
$target_path = APPLICATION_PATH . "/../public/contract/";
$target_path = $target_path . basename( $_FILES['contractfile']['name']);
if(move_uploaded_file($_FILES['contractfile']['tmp_name'], $target_path))
{
$result = true;
}else{
$result = false;
}
}
}
答案 0 :(得分:6)
将文件移出公共目录,并在授权用户后使用PHP对其进行流式传输。
if (is_authorized($user)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename='.basename($path_to_file_outside_public));
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($path_to_file_outside_public));
readfile($path_to_file_outside_public);
}