Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a site that will need to store file uploads by the user once logged in. Currently I have a folder with permissions opened up, (777), because that was the only way I could get mkdir() to work. When the user uploads a file, the application creates several directories based on the user, in this directory then eventually stores the file.

Couple of questions:

  1. How do I setup the permissions on each of these folders and sub folders so that only logged in users to my site have access to them? Is this even possible?

  2. Is there a more secure way of storing .pdf, word docs, and text files?

share|improve this question

migrated from stackoverflow.com Sep 16 '12 at 1:26

This question came from our site for professional and enthusiast programmers.

    
I suspect you could do it with .htaccess, possibly together with a PHP-script that is pre-run to check if the user is logged in. However I do not know the directives you will need to use. –  Andreas Hagen Sep 14 '12 at 15:49

2 Answers 2

You need to prevent people from directly accessing the folder via the web. you have two options:

  1. Move the upload folder to be outside of the DOCUMENT_ROOT so that it's not web-accessible.
  2. Make a .htaccess file that blocks access to the folder or redirect to a PHP script that checks for access.

After using one of the above options, you will need to load a PHP script that checks the access and serves the files to each user. I suggest using a URL like "...myphpscript.php/path/to/file" and the $_REQUEST["PATHINFO"] variable to simplify things.

share|improve this answer

can give permission recursive for subfolders

chmod 777 -R folder
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.