[英]PHP: How can I block direct URL access to a file, but still allow it to be downloaded by logged in users?
I have a website where users should be able to log in and listen to a song (a self-created mp3). 我有一个网站,用户应该可以登录并听一首歌(自己创建的mp3)。 I want to make it so the logged in user can listen/download/whatever, and the file should reside on the server (not be stored in the MySQL database), but not be able to be accessed by non-users who have the path to the URL.
我要这样做,以便登录的用户可以侦听/下载/无论如何,并且该文件应驻留在服务器上(而不是存储在MySQL数据库中),但不能被具有该路径的非用户访问URL。
For example: say my mp3 is located at mysite.com/members/song.mp3 If you are logged in, you should be able to see the mysite.com/members/index.php page, which will allow access to the song.mp3 file. 例如:说我的mp3位于mysite.com/members/song.mp3。如果您已登录,则应该能够看到mysite.com/members/index.php页面,该页面将允许访问该歌曲。 mp3文件。 If you're not logged in, the mysite.com/members/index.php page will not show you the song.mp3 file, and linking directly to it should not grant access.
如果您尚未登录,则mysite.com/members/index.php页面将不会向您显示song.mp3文件,并且直接链接至该文件不应授予访问权限。
I'm pretty sure this is done via htaccess, and I have done a lot of Googling already, and searched on here. 我很确定这是通过htaccess完成的,并且我已经做了很多谷歌搜索,并在这里搜索。 The two closest answers I found were this htaccess guide http://perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/ and this StackOverflow question Block direct access to a file over http but allow php script access but neither answer all my questions to meet my criteria.
我找到的两个最接近的答案是此htaccess指南http://perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/和这个StackOverflow问题: 阻止通过http直接访问文件,但允许php脚本访问 ,都不回答我所有的问题以满足我的标准。 What am I missing?
我想念什么?
Into folder members create new folder files , move here all your songs, create new .htaccess file and add the following lines: 放入文件夹成员中,创建新的文件夹文件 ,将所有歌曲移到此处,创建新的.htaccess文件,并添加以下行:
Order Deny,Allow
Deny from all
Into folder members create file get_song.php and add the following code: 进入文件夹成员,创建文件get_song.php并添加以下代码:
if( !empty( $_GET['name'] ) )
{
// check if user is logged
if( is_logged() )
{
$song_name = preg_replace( '#[^-\w]#', '', $_GET['name'] );
$song_file = "{$_SERVER['DOCUMENT_ROOT']}/members/files/{$song_name}.mp3";
if( file_exists( $song_file ) )
{
header( 'Cache-Control: public' );
header( 'Content-Description: File Transfer' );
header( "Content-Disposition: attachment; filename={$song_file}" );
header( 'Content-Type: application/mp3' );
header( 'Content-Transfer-Encoding: binary' );
readfile( $song_file );
exit;
}
}
}
die( "ERROR: invalid song or you don't have permissions to download it." );
And now, you can use this URL to get the song file: 现在,您可以使用以下URL来获取歌曲文件:
http://mysite.com/members/get_song.php?name=my-song-name http://mysite.com/members/get_song.php?name=my-song-name
The only thing you can do for this via .htaccess is require a referer that comes from your site, and it is NOT secure. 您只能通过.htaccess来执行此操作,因为它需要来自您网站的引荐来源网址,因此并不安全。 it is beyond trivial to forge a referer and anyone could suck your site dry.
伪造一个引荐来源并不容易,任何人都可以使您的网站枯竭。
The ONLY way you'll be able to have only logged-in users download the file is by placing the file OUTSIDE of your webroot and having a PHP script mediate access. 只有登录用户才能下载文件的唯一方法是将文件放在Webroot的外部,并具有PHP脚本中介访问权限。 In short:
简而言之:
if (is_logged_in()) {
readfile($name_of_file);
} else {
die("Access denied");
}
Are you using a scripting language such as PHP to handle your website? 您是否正在使用PHP之类的脚本语言来处理您的网站? if so then the best way is to create a script that handles "delivery" of the content.
如果是这样,那么最好的方法是创建一个处理内容“交付”的脚本。 Save the content in a protected directory, ie above your http or www folder.
将内容保存在受保护的目录中,即在http或www文件夹上方。 Then when the user is logged in, the link to your content would look like this:
然后,当用户登录后,指向您内容的链接将如下所示:
http://yoursite.com/listen.php?song_id=xxx http://yoursite.com/listen.php?song_id=xxx
the script will locate the required song by the id and then present the data to the user 脚本将通过ID找到所需的歌曲,然后将数据呈现给用户
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.