htaccess - 禁止直接访问除登录用户以外的所有文件 (PHP)

Question

Using.htacess (deny from all) - is it possible to only allow users who are logged in my system to directly access files? If it makes any difference my site is built with Drupal (PHP). If this is possible then ideally I would ideally I would like to check the user's role as well.

Answer 1

You cannot do this with .htaccess alone. What you need to do is:

1. Deny file access from all
2. Have a "file provider" script which allows file passthrough after authentication.

Example:

proxy.php

<?php 
$proxiedDirectory = "./files/"; //Whatever the directory you blocked access to is.
$filename = isset($_GET["fn"])?$_GET["fn"]:null;

if (!user_is_authenticated()) { //Not a real method, use your own check
    http_response_code(403);
    exit;
}

if ($filename === null || !file_exists($proxiedDirectory.$filename)) {
    http_response_code(404);
    exit;
}



$fp = fopen($proxiedDirectory.$filename, 'rb');

header("Content-Type: image/???"); //May need to determine mime type somehow
header("Content-Length: " . filesize($proxiedDirectory.$filename));

fpassthru($fp);
exit;

And you'd use this via:

http://example.com/proxy.php?fn=filename.txt