Forum Moderators: coopster
The directory will only contain a bunch of pdf files, but I dont want people that arent logged in to see the pdf files, and I dont want to enter 3000 users into the htpassword directory, and I dont really want the people that already logged in to have to log into the secure directory again.
My ideal sollution would be to have the user click on the link for the file they want to see, and have the PHP file enter the username and password of the secured directory, and open the file for the user so they dont even have to know that its secure. that way any user can look at the file, but if someone just tries to type in the direct address of the file, they'll get a password prompt.
Any ideas? Is this possible?
Andy
Yes, it is possible, but I have never done it that way myself. I would keep the documents below the document root and if a user requests one of the docs you would authenticate them using your current database/authentication setup, read the file into a string variable, then push your own headers and the file down to their browser.
or if anyone can give me any hints on how to do it the .htaccess/htpasswd way that would be cool to.
I dont really care how it ends up working, as long as it works :)
[edited by: andyd273 at 1:26 pm (utc) on June 13, 2005]
<?
echo "<html><head><title>Newsletter Archive</title></head><body>";
include_once("include/session.php");
if(!$session->logged_in){
header("Location: main.php");
}
else{
if($filename){getFile($filename);}
?>
Welcome to the Newsletter Archive.<br>
More Coming soon!<br>
<p>
<script>
function input(){
document.archive.filename.value="GMPP_Letter_10-7-2004.pdf";
document.archive.submit();
}
</script>
<form action="archive.php" id="archive" name="archive" method="post">
<input type="hidden" name="filename" id="filename">
<ul>
<li><a href="javascript:input()">GMPP Letter 10-7-2004</a></li>
</ul>
</form>
</p>
<?
}
function getFile($theFile){
header ("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header ("Content-Type: application/pdf");
header ("Content-Length: " . filesize($theFile));
header ("Content-Disposition: attachment; filename=$theFileName");
readfile($theFile);
}
echo "</body></html>";
?>
but now when it prompts to open, it always gives the file name as archive.pdf (archive.php is the name of the php file). is there a way to make it give the real file name for the pdf that it is opening?
<?
if($filename){
$path = "../../nlArchive/";
$theFile = $filename;
header ("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header ("Content-Type: application/pdf");
header ("Content-Length: " . filesize($theFile));
header ("Content-Disposition: attachment; filename=$theFileName");
readfile($path.$theFile);
}
else{
include("include/session.php");
if(!$session->logged_in){
header("Location: main.php");
}
else{
echo "<html><head><title>Newsletter Archive</title></head><body>";
?>
Welcome to the Newsletter Archive.<br>
More Coming soon!<br>
<p>
<script>
function input(){
document.archive.filename.value="GMPP_Letter_10-7-2004.pdf";
document.archive.submit();
}
</script>
<form action="archive.php" id="archive" name="archive" method="post">
<input type="hidden" name="filename" id="filename">
<ul>
<li><a href="javascript:input()">GMPP Letter 10-7-2004</a></li>
</ul>
</form>
</p>
<?
echo "</body></html>";
}
}
?>
header ("Content-Disposition: attachment; filename=$filename");
<?
if($filename){
$path = "../../nlArchive/";
$theFile = $filename;
header("filename=\"$filename\"");
header ("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header ("Content-Type: application/pdf");
header ("Content-Length: " . filesize($theFile));
header ("Content-Disposition: attachment; filename=$filename");
readfile($path.$theFile);
}
else{
include("include/session.php");
if(!$session->logged_in){
header("Location: main.php");
}
else{
echo "<html><head><title>Newsletter Archive</title></head><body background='../Images/bg.jpg'>";
include("include/header.php");
echo '<div id="Body" style="position:absolute; width:461px; height:392px; z-index:0; left: 306px; top: 160px; overflow: auto; overflow-x: hidden" class="bodytext">';
?>
<span class="header">Welcome to the Newsletter Archive.</span><br>
<p>
Back to [<a href="main.php">Main Page</a>]
</p>
<p>
<script>
function input(filename){
document.archive.filename.value=filename;
document.archive.submit();
}
</script>
<form action="archive.php" id="archive" name="archive" method="post">
<input type="hidden" name="filename" id="filename">
<ul>
<?
if ($handle = opendir('../../nlArchive')) {
while (false!== ($file = readdir($handle))) {
if ($file!= "." && $file!= "..") {
$temp=explode(".",$file);
echo "<li><a href=\"javascript:input('$file')\" onMouseMove=\"javascript:window.defaultStatus='welcome'\" onMouseOut=\"javascript:window.defaultStatus=''\">$temp[0]</a></li>";
}
}
closedir($handle);
}
?>
</ul>
</form>
</p>
<?
echo "</body></html>";
}
}
?>
Every other brower behaves as it should, but MS IE ignores standards, RFC2616 to be specific. We have to make fake <a href> links in order for MS IE to act like a real browser that respects standards (if we don't, MS IE will not *use* the filename in the parmameter specified).
