使用apache / php拒绝直接访问文件夹中的任何文件

Question

This might seem like a duplicate question but I have tried the solution given in the similar questions.

I want to limit access to files in a few folders on my apache server so that they can only be served through a php script to only the users logged in to the part of my system that should have access to any particular folder.

Other solutions suggest using the .htaccess

deny from all
allow from 127.0.0.1

But that seems to deny the files from everywhere.Including the local php scripts.

Im considering .htpasswd but that is an extra level of user credentials that needs to be handeled and I'd prefere to avoid that.

How should I get around this? Is there any better way of storing the files?

Answer 1

htaccess cannot deny access to files via php using include/require functions. If your php include is not accessing the file then the problem is the path to the file.

Answer 2

Somehow php was restricted by the

deny from all
allow from 127.0.0.1

to include and require files in the affected folders. This goes against what I can read from the apache documentation how this should work and I have no real answer why. The problem persisted both on my localhost using Xampp and on the webhotel one.com.

My original question was badly formed since I used require to test if I had read access to the folder when I actually wanted to use readfile.

My main concern was that I wanted to serve files for download from an inaccessible directory. And the

readfile($filename);

could still access the files.

The soultion to this problem was that I realized that readfile() and include() somhow gets different permissions. I could not find this in any documentation.