阻止来自直接 URL 的访问，但不阻止来自 mysql 数据库中的用户的访问

Question

I have a database named users, with a table named users that contains user/pass/email for people to access my site. The purpose of the website is for musicians to share their music and/or recorded performances with each other. I want to restrict file access to all besides the users in my db/table.

I have the .mp3 files outside of the www directory. I'm currently using this:

<?php
header('Content-Type: mp3');
readfile("../Music/" . $_GET['mp3']);
?>

And to call:

<a href="music.php?mp3=songnamehere">Song name here</a>

However, if you know the direct link you can download it w/o any permissions.

example.com/music.php?mp3=songnamehere

I have tried to combat this with .htaccess, but still accessible with direct url:

# secure htaccess file
<Files .htaccess>
order allow,deny
deny from all
</Files>

To no avail, I still cannot get it to work. I need something that works with my db/table that has the users/pass/email and blocks direct url access for non users.

Any information you can provide will be a big help. However, I'm not an expert with php so explain as much as you have the effort. Thank you

Answer 1

I use readfile() with a hashing of a string to prevent unauthorized url access. You can use the file name and userid as part of your hashing to make sure url alone would not be sufficient. I've created a simple hashing process to give you ideas. Hope this helps.

UPDATE The following code is expanded to give a full working example

<?php
  //**************************************************************************
  // the following code should be placed with your login verification code, 
  // substituting the correct userid  or username
  //**************************************************************************
  if (!isset($_SESSION)) {
      session_start();
  }
  // you will have to set the userid from 
  $_SESSION['userid'] = "user3453965";
  //**************************************************************************
?>



<?php
  //**************************************************************************
  //The following code is in a separate php from the above - e.g. music.php
  //**************************************************************************
  if (!isset($_SESSION)) {
      session_start();
  }
?>

Music File to download:<br>
<a href="<?php echo $_SERVER['PHP_SELF'] . "?file=" . urlencode("16 Bit - Twice.mp3") ?>">16 Bit - Twice.mp3</a><br>
<a href="<?php echo $_SERVER['PHP_SELF'] . "?file=" . urlencode("test.mp3") ?>">test.mp3</a><br>


<?php
  if (isset($_GET['file'])){
      // a file is chosen to download
      $file = urldecode($_GET['file']);
      if (file_exists($file)){  
        if (isset($_SESSION['userid'])){
          //****************************
          // check that the userid is valid
          //****************************
          if (valid_user($_SESSION['userid'])){
            $userid = $_SESSION['userid'];
            // generates a hash to validate the request
            $hash = gethash($file, $userid);
            downloadfile($file, $hash, $userid);
          }
        }
      }
      else{
        echo "<br>File not found: $file<br>";
      }
  }

  function valid_user($userid){
      // check that the userid if valid = e.g. call to database or however you want
      // I am using an array for this example so it can be stand alone
      $valid_users = array("henry mcmuffin", "user3453965");
      if (array_search($userid, $valid_users)){
        return true;
      }
      return false;
  }

  function gethash($string, $userid){
      // use your own method of hashing here
      // you can pass the user id and make this part of the returned string
      return md5($string . $userid);
  }


  function downloadfile($file, $hash, $userid, $outfilename=""){
      if (!isset($_SESSION)) {
          session_start();
      }

      // prevent url hacking
      // define gethash() to hash the filename
      $hash2 = gethash($file, $userid);

      // if hash correct 
      if ($hash == $hash2) {

          // File Exists?
          if (file_exists($file)){
              // Parse Info / Get Extension
              $fsize = filesize($file);
              $path_parts = pathinfo($file);
              $ext = strtolower($path_parts["extension"]);

              // Determine Content Type
              switch ($ext) {
                  case "mp3": $ctype="audio/mpeg"; break;
                  case "pdf": $ctype="application/pdf"; break;
                  case "gif": $ctype="image/gif"; break;
                  case "png": $ctype="image/png"; break;
                  case "jpeg":
                  case "jpg": $ctype="image/jpg"; break;
                  default: $ctype="application/force-download";
              }

              header("Pragma: public"); // required
              header("Expires: 0");
              header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
              header("Cache-Control: private",false); // required for certain browsers
              header("Content-Type: $ctype");

              $outfilename = ($outfilename=="" ? basename($file) : $outfilename);
              // Download file
              header('Content-Disposition: attachment; filename='.basename($outfilename));

              header("Content-Transfer-Encoding: binary");
              header("Content-Length: ".$fsize);

              if (ob_get_length() > 0 ) {
                // clear the buffer to allow download
                ob_clean();
                flush();
              }
              readfile( $file );
          } 
          else {
              echo('File Not Found: ' . $file);
          }
      }
      else {
          echo ('Invalid file request');
      }
  } 
?>

Answer 2

you can use sessions for this if user log in check page set same variable your login page add something like this

<?php
session_start();
$_SESSION['login']='login';

?>

in your music.php page

<?php
session_start();
if(isset($_SESSION['login'])){
header('Content-Type: mp3');
readfile("../Music/" . $_GET['mp3']);
}
else{
header('Location: login.php');

}
?>