将pdf文件安全地存储在服务器上

Question

I am deploying a website from where user can purchase the pdfs. now i am searching for the way for storing the pdfs so that it only can be downloaded when payment is done. I have came across one way in which i can store the pdfs in to the Mysql database and generate the path to it when required credentials fulfill.

Is there any other way to do this and link to the pdf file should be dynamic and encrypted so that other links to the other books can't be predicted.

and the server side language I am using is PHP

Answer 1

I would :

• Deny any access to the files -- ie use a .htaccess file (That way, no-one has access to the file)

• Develop a PHP script that would :

  • receive a file identifier (a file name, for instance ; or some identifier that can correspond to the file)
  • authenticate the users (with some login/password fields), against the data stored in the database if the user is valid, and has access to the file (This is if different users don't have access to the same set of files), read the content of the file from your PHP script, and send it the the user.

The advantage is that your PHP script has access to the DB -- which means it can allow users to log-in, log-out, it can use sessions, ...

Here is another answer from a stack user that fits this problem: Creating a Secure File Hosting Server for PDFs

Answer 2

1. You need to store the files somewhere outside your website root like mentioned by Dagon. When file is uploaded use move_uploaded_file to move it. You can name the file anything you want (within OS limits) and keep the real name in the database.
2. Then when the user has payed for the books, add the books the user has payed for to a table in a db.
3. Give the user a list of all the books he has payed for like: /download/filename.pdf
4. Add a mod_rewrite if you use Apache (or equivalent for other web servers) where /download/.* is redirected to download.php or a controller.
5. On the download page, check if user is logged in and has access to the file. If not, redirect to purchase page for that book.
6. If download is ok set header for the http status you need: Content-Length, Content-Type, Date, Status (200), maybe Content-Encoding.
7. Use readfile to output the file to the end user.

Answer 3

is there any other way to do this and link to the pdf file should be dynamic and encrypted so that other links to the other books can't be predicted.

1. The best way, is after payment generate a key to the file.
2. create a page like this www.site.com/download.php?key=key (and here you don't need to have id of the book, because by the key you can check on the database what is the book the customer purchased .
3. inside the download.php read the key, query the database to find which file is linked with the key
4. read the file, and send it to the customer. This is, if the key is valid, you will send the php headers as content type as being pdf, and (the php code) read the file in binary and send it in the message body.

I hope this code helps

<?php
// We'll be outputting a PDF
header('Content-type: application/pdf');

// It will be called downloaded.pdf
header('Content-Disposition: attachment; filename="downloaded.pdf"');

// The PDF source is in original.pdf
readfile('original.pdf');
?>