从htaccess禁用文件夹公共访问

Question

I have a website from which you can downloads resources.

What I want is to disable public access for the folder on which the items are stored but allowed them to be accessed by website for download.

I've used Order deny,allow in .htaccess but if i use that I can't download from the website.

It will will give me error 404 same as trying to type direct url for the file. The download is performed.

I have the following code:

       $link = $item->link;

        $link_headers = get_headers($link);

        //Headers
        if(isset($link_headers[0]))
        {
            header($link_headers[0]);

        }//if exists
        if(isset($link_headers[1]))
        {
            header($link_headers[1]);

        }//if exists
        if(isset($link_headers[2]))
        {
            header($link_headers[2]);

        }//if exists
        if(isset($link_headers[3]))
        {
            header($link_headers[3]);

        }//if exists
        if(isset($link_headers[4]))
        {
            header($link_headers[4]);

        }//if exists
        if(isset($link_headers[5]))
        {
            header($link_headers[5]);

        }//if exists
        if(isset($link_headers[6]))
        {
            header($link_headers[6]);

        }//if exists
        if(isset($link_headers[7]))
        {
            header($link_headers[7]);

        }//if exists
        if(isset($link_headers[8]))
        {
            header($link_headers[8]);

        }//if exists

        readfile($link);

        exit;

Thing is if i put .htaccess with deny all into the folder that holds all the items for download then download will not work anymore because i don't have permission and i want that to be available only for people who try to download from direct link to the file from url.

Answer 1

If you protect your file and file path, you can use a download.php file.

download.php file content

<?php
// Connect to db and get file information from db.
// $db_filename and $db_filetype getting from db

header("Content-disposition: attachment; filename=def.file_type"); // def.pdf
header("Content-type: " . $db_filetype);  // application/pdf
readfile("/path/of/your/files/".$db_filename); // /project/home/downloads/abc.pdf

Usage :

download.php?file_id=1

This usage is protect your folder and file name, but it use database.

Answer 2

One way to achieve this is to download via a script that checks for the http-referrer. The header can of course be modified manually, but I think doing something more complex than this would be an overkill:

/*
Change your download links to point to a php script, or use .htaccess to rewrite downloads to the same file
*/
<a href="download.php?file=somefile.zip">Download</a>

//download.php

if ($_SERVER['HTTP_REFERER'] == "your_downloads_page.html") {
    $file = $_GET['file'];
    if (file_exists($file)) {
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename='.basename($file));
        header('Expires: 0');
        header('Cache-Control: must-revalidate');
        header('Pragma: public');
        header('Content-Length: ' . filesize($file));
        readfile($file);
        exit;
    }
}

However be sure to add some security checks so that users can't download files they shouldn't be allowed to. Perhaps filter all slashes and double dots.