Above public_html

by 11 replies
13
Hi Everyone,

Must apologize, I do not often come around this forum.

If anyone could offer me advice on this I would be thankful.

Problem

I want my download folder above the public_html directory.
For security reasons of course.

Possible solutions on how to achieve this anybody??.....................

Thanks

Jim
#programming #publichtml
  • Don't do it.

    1) You have to own full access to the server in order for this to even work.
    2) Allowing public access to folder's above public_html will actually make the server MORE vulnerable.

    That would be a serious mistake, use another option, even if it means password protecting a folder, just make sure everything on the web is in public_html otherwise you'll be extremely vulnerable.
  • 2) There's nothing unsafe about putting his download folder above public_html. It is in no way accessible through the web server above the document root, so it's not publically accessible. The only way people are going to be able to download from there is through a script in public_html or below that the files pass through. Meanwhile, putting the folder there prevents any direct access at all, so the files can't be stolen even if someone figures out the filenames.

    1) Not true, even through a basic FTP program, you have permission to your entire user directory, not just the web server document root and below. He can create folders at the same level or above public_html.
    • [1] reply
    • Hi Guys

      Thank you for replying.

      I was probably not to clear with my request. Apologies for that.

      I have always been under the impression it was safer to have a downloads folder above the public folder.

      Creating a download folder there is not my problem.

      My problem is with the link required to access that folder (a download link)

      Cheers

      Jim
      • [1] reply
  • I'm not trying to sell anything here, just saying he can put the downloads folder above public_html without it being insecure... I tried to write the (secure) download script for him but the forum kept arbitrarily deleting variables from the [code] block so I had to delete it... don't know what your problem is.
    • [1] reply

    • Dan. I think you need the [ php ] block instead. Or others have complained of it deleting out the dollar sign

      And I think DoubleAgent is really not listening.

      I use this basic procedure on my ASP.NET sites

      MainSite folder
      Downloads folder
      Blog folder

      the files go into Downloads, and cannot be reached except with an FTP program and my admin level FTP accounts

      In my main site folder I have a login protected section, which does IP recording, etc for validation (to prevent sharing) including a downloads page.
      The downloads page lists the files a user has access to using a "made up" url pointing to a folder that doesn't exist and the file name.

      Then I have a handler script for the made up folder that intercepts the requests, validates the user details and streams the file from the downloads folder to the user if allowed.

      The downloads cannot be reached without being logged in, and only those a person has rights to.
      • [1] reply
Join the discussion

Next Topics on Trending Feed