拒绝直接访问 php web 文件夹中的 PDF 文件

Question

There is a fully running PHP site that can only be accessed when logged in with ID/password.

I have been asked to add a function to the site that uploads PDF files and show existing PDF files in the browser.

So I achieved this by using iframe to embed PDF files in the browser.

But the problem is, the PDF files shouldn't be directly accessible (shouldn't be opened when accessing www.aaa.com/pdf/test.pdf), and must only be shown in the site so that only authorized users can view the file.

So I tried a few things :

1. .htaccess : I'm not too familiar with PHP/HTML so searched some answers on stackoverflow and tried them without success.

such as

order deny,allow
deny from all
allow from 127.0.0.1

or

Require local

and so on. It obviously blocked direct access, but also didn't allow the PDF to be shown from the site (www.aaa.com/showPDF.php). Come to think of it, the above methods seem to only allow the files to be read when opened from the physical server.

2. Moving the PDF folder outside of webroot : I succeeded moving the upload folder outside of webroot and also uploading to it, but then iframe doesn't work since PHP can't find the PDF file. A workaround was to use headers and PHP readfile(), but I can't seem to modify the headers from where I'm from since the headers are already sent beforehand in files that I cannot modify.

I think I'm making this overly complicated, and I think an appropriate .htaccess file will simply do, but don't have much knowledge in this area. Would really appreciate help here, thanks!

Answer 1

Seems it was simple enough.

 Order Deny,Allow Deny from all Allow from www.aaa.com

worked. Thank you for your suggestions!

=======================================

Edit : above didn't work.

In fact, I didn't have permission to access outside my webroot. So I stored the pdf files inside a folder within my webroot and denied access from all by using :

Deny from all

in .htaccess.

After that, since iframe was denied by .htaccess, I tried to print the contents of the PDF by using file_get_contents(). But this required setting header information such as

$contents = file_get_contents($filePath);
header('Content-Type: ' . mime_content_type($filePath));
header('Content-Length: ' . filesize($filePath));
echo $contents;

But the php page that shows the contents of the PDF file (showPDF.php) already sent out headers during initializing, and I didn't have rights to modify that part.

So I made a fresh php file (pdfviewer.php), added session information, and added the above 4 lines. After that I iframed pdfviewer.php within showPDF.php and it finally worked.

I think this problem was REALLY specific to my current situation but hope someone finds it useful.

Also, thanks @CBroe since I realized I was wrong and got some hints!