0

I am creating website which is similar to dropbox. My logic behind the project is that I am going to create 1 table which includes username and pass and unique id.

Then I will create folder with name as that of the unique code and I will store that particular person file like video, mp3, txt in that particular folder. Now my question is how to restrict other users from entering into that folder(because I can access that folder by directly entering the url)?

Also suggest me if any other logic is more efficient.I am working on mini project.

2
  • Never store users files in publicly accessible folders. Store them outside of the web-root and serve them through php.
    – jeroen
    Sep 2, 2016 at 7:10
  • Please edit your question to show what you have tried so far. You should include a Minimal, Complete, and Verifiable example of the code that you are having problems with, then we can try to help with the specific problem. Sep 2, 2016 at 7:11

2 Answers 2

1

I believe that Google Drive (and Dropbox probebly too), use https behind the scenes. In that case you simply need to make sure that your php/asp files make sure only the logged on user can access his/her files. It all depends on how your creating your cloud platform. You could also use scp, ssh, in that case your server automatically directs the client command to his/her own files.

2
  • 1
    HTTPS has nothing to do with this. If you want to restrict access and associate it to the PHP login, you have to rewrite the url to a PHP script which checks the permissions. Sep 2, 2016 at 7:27
  • What you can do is put the non-php files in a seperate directory outside the public folder so it cannot be accessed. Then create a php file around it that will do a header binary stream to the client, since the php file can access the file. But i'm not sure if he is using http(s), he might as well create a client that uses a complete different protocol, in that case he could use scp and use a ssh key to get to the files.
    – Saskia
    Sep 2, 2016 at 8:08
0

You would need to create a controller that handles access to files. Do not direct link to the files, for example if you pass your arguments as /myFolder/myImg.jpg, then the controller would take the logedin user unique_id and the path as arguments, and then it would create a path it self.

2323-2332-a51df/myFolder/myImg.jpg

The idea is that the uniqueID will serve as base path, and your controller will handle all file access. This way you dont have to chmod 777 anything. Your controller will have access only to the folders you require and all will remain within your php settings. No need to worry about somebody trying to access any system folders.

Next to that you would just need to load the file contents and return it with the appropiate mime type.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.