Page 1 of 1

force download file in php

Posted: Mon Oct 28, 2013 12:32 pm
by new_member
Hi,

I want to restrict access to specific folder if some one copies and paste download file link or folder in browser. For that i have modified my htaccess file and added following lines of codes in that

RewriteEngine On
RewriteCond %{REQUEST_URI} \.(doc|zip|pdf)$ [NC]
RewriteRule ^(.*)$ /download-pdf.php?filename=$1 [L]

Beside this i have placed plenty of codes searcher from google to make it accessible when accessed from my domainsite.com

http://stackoverflow.com/questions/1962 ... row-script

http://stackoverflow.com/questions/1365 ... rowser-url

and searched almost every site. But restricting access to my files will not allow me to access it through my site also.

The only solution i came across is to force download the restricted file if accessed through my site. For that i have made forcedownload.php file and reading the contents of file in that. But the problem is that how to add condition in htaccess to go to download page if accessed through my site. Any help??

Re: force download file in php

Posted: Mon Oct 28, 2013 2:30 pm
by requinix
The key thing to check that isn't always present even when you'd expect it to be is the HTTP_REFERER.

Either handle it in the rewriting

Code: Select all

RewriteEngine On
RewriteCond %{REQUEST_URI} \.(doc|zip|pdf)$ [NC]
RewriteCond %{HTTP_REFERER} domainsite.com/
RewriteRule ^(.*)$ /download-pdf.php?filename=$1 [L]

# if you also need to explicitly deny access (like if the files do exist at that location)
RewriteCond %{REQUEST_URI} \.(doc|zip|pdf)$ [NC]
RewriteCond %{HTTP_REFERER} !domainsite.com/
RewriteRule ^ - [F]
or, of course, you can check it in your PHP.

Re: force download file in php

Posted: Mon Oct 28, 2013 9:04 pm
by new_member
i have tried the above code usinf http_reffere but it does not work as i have bundle of files and are being reffered by multiple places. i cannot refer all the link here using this
RewriteCond %{HTTP_REFERER} domainsite.com/.

More i cannot understand where to put this download.php file and how to pass the filename to it??

Re: force download file in php

Posted: Mon Oct 28, 2013 10:40 pm
by requinix
new_member wrote:i have tried the above code usinf http_reffere but it does not work as i have bundle of files and are being reffered by multiple places. i cannot refer all the link here using this
RewriteCond %{HTTP_REFERER} domainsite.com/.
Then maybe you should do the logic in the PHP script instead. Store a set of legitimate domain names somewhere and make your PHP script check if the referrer was from any of them. Look at $_SERVER["HTTP_REFERER"].
new_member wrote:More i cannot understand where to put this download.php file and how to pass the filename to it??
Put it in the root of your website. The filename is already being passed in through $_GET automatically:

Code: Select all

/download-pdf.php?filename=$1

Re: force download file in php

Posted: Mon Oct 28, 2013 10:59 pm
by new_member
i will put the domain names in php script. But what if in future some new functionality is added and same files are called from some newly created page(refferer)?? It will cause problems

Re: force download file in php

Posted: Tue Oct 29, 2013 1:19 am
by requinix
Then add them to the script. Or database.