PHP阻止直接访问文件，但仍在下载脚本中使用

Question

I have simple download script (used for Wordpress file downloads

if($filesize) {
        header('Content-Type: application/octet-stream');
        header("Content-Transfer-Encoding: Binary"); 
        header("Content-disposition: attachment; filename=\"" . basename($file_url) . "\""); 
        readfile($file_url);
    } else {    
        echo '<p>No file found</p>';
    }

I want to prevent users from accessing download files by direct access to them, so if user types in the path in browser, file should not be accesible.

I've tried this with .htaccess but without results. It was blocking the file directly but also script won't download the file.

Any help?

Thanks!

Answer 1

如果文件与PHP脚本位于同一框，请将其移出Web服务器目录，以便脚本可以访问它们，但用户不能访问它们。

Answer 2

i will assume that User need to click certain button to get the file ,means a post method ,and if not from post you show theme an error message,

if($_SERVER['REQUEST_METHOD'] != 'POST'){
   echo 'Error: You cannot access this link Directly';
}

im also assuming you have your files on separate Folder where you can create new .htaccess file with the following rules:

Order Deny,Allow
Deny from all

Answer 3

to solve this issue what you can do is you can keep the script file out of folder where download files and .htaccess files are located.

By doing so users cant access download file directly if user types in the path in browser, file will not be downloaded. they can only access files via script.

hope it makes sense.