how to use .htaccess to control php file open behavior 2

[flubbard]

I have written a php viewer that displays various text files. The text files are stored within subdirectories with the viewer in the root.

I would like for users to only view text files that they have rights to according to an .htaccess file located in the directory with the text file.

The problem is, everyone has to have rights to the viewer. Basically, I would like the php file to only be able to open the text file in the subdirectory if a valid user is logged in. Is there a way to do this using .htaccess, is there a better alternative, or do I need to create my own file access control code?

Any help would be appreciated.

 

[Wishdiak]

flubbard,

If your php script is in a different directory than your text files, you can restrict access to the text file directory with .htaccess, such as

/path/to/php
/path/to/text

Wishdiak

http://www.wishdiak.com

 

[flubbard]

Wishdiak,

Would this still keep the php script from accessing the file unless a valid user has logged on? The text file itself is not be displayed by apache but only through the viewer (it is being opened and processed by the script).

Might there be a setting that I need to change in either httpd.conf or php.conf that would produce the behavior. When I tried to put an .htaccess file into the text directory, the viewer opened it and showed it without asking the user to log in (the already logged in user did not have proper permissions under the .htaccess file)

Thanks in advance for any help you can provide.

 

[sleipnir214]

You can't use .htaccess in this way.

Apache applies .htaccess security directives only when a browser connection comes in through the network. PHP's access to files is simply a filesystem function that Apace has not control over.

Even if you were to put these files into a directory and access them using HTTP URLs in PHP's filesytem functions, you would have no control over what would be accessed, as PHP will run as the same user every time -- the user as which Apache runs.


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[flubbard]

sleipnir

Thanks for the help...that's kind of what I figured. I guess its on to writing a little access control routine within the script.

 

[Wishdiak]

sleipnir214,

Thanks for straightening me out on that one. Good to know.

Wishdiak

http://www.wishdiak.com