通过PHP脚本进行BASIC身份验证

Question

I'm new to this particular subject matter. I have spent half a day searching. I can't take it anymore, so here goes...

I'm working on a site that allows users to upload audio files to the server. I save these files in a folder within the http document. Users can listen to the audio files they uploaded using jPlayer.

I have protected the folder where I saved the songs in with Apache BASIC Authentication in order prevent direct url access by the public at large. But once a user logs in to our web app (using our application's login mechanism), I want that user to have access to the song folder so that he can play his songs (preferrably for the duration of his session).

Any leads will be appreciated. Thanks.

Edit: Just an added note, the basic authentication will be made from a php file that is not located within the songs folder.

Answer 1

One solution that has worked for me in the past is to use a PHP script to give people access to the files. Let's call this download.php . Instead of giving the logged in user direct access to the actual location of the files, they need to access the files through download.php and send the file name as a $_GET parameter, like:

download.php?file=some_awesome_song.mp3

This way, you can control things like, number of downloads remaining, whether they need to wait a certain amount of time before downloading it (like a download countdown on certain sites), to prevent them from accessing files from another user, etc.

You could also just forget about HTTP authentication and use .htaccess to completely deny access to the directory that the downloads are located with:

deny from all

or store the files outside of the web root.

In your PHP do something like this:

<?php

session_start();

// Make sure user is logged in
if (isset($_SESSION['user_id'])) {
    die("You are not logged in");
}

// Make sure user has access to download the file
// Replace with your own methods if applicable
if ($_SESSION['user_has_permission_to_download_file'] === false) {
    die("You don't have permission to access that file");
}

// Make sure we're not trying to open anything outside of that directory
$filename = basename($_GET['file']);
// Replace with the actual location
$path = '/actual/path/to/file/' . $filename;

if (!file_exists($path)) {
    die("The requested file does not exist");
}

if (!is_readable($path)) {
    die("Permission denied while trying to open file");
}

$contents = file_get_contents($path);

// Set content type header based on file
header("Content-type: ".finfo_file($path));

echo $contents;