Re: How To Limit FIle Uploader Against Hijackers?
| From: | Michael A. Peters | Date: | Sat, 30 May 2009 22:40:36 +0000 |
| Subject: | Re: How To Limit FIle Uploader Against Hijackers? | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-293395@lists.php.net to get a copy of this message | ||
Nitsan Bin-Nun wrote:
What do you mean by session variables? I should register a new session and pass it along with the file to the PHP wrapper?Yes - in the page that links to your downloads you can do something like $_SESSION['download']=TRUE; then in the wrapper - if (isset($_SESSION['download'])) { $allowed=$_SESSION['download'] } else { $allowed=FALSE; } the check the $allowed variable. Only way the file will be sent is if they have been to your site that creates a session for them and sets the $_SESSION['download'] variable to TRUE. You can check whatever you want from the session variables. For some of my files, I check the userid in the session variable and make sure the user is allowed to download it. If they aren't, they get a 401 forbidden header and page.