Hello I am using PHP to allow users to upload files and I have them sitting in a folder outside webroot (/var/www) folder for security reasons. It is in the folder /var/uploads. A user uploads files for specific records. Once the the uploaded files are moved to the uploads folder, the address of the attachment is stored in the database. Now whenever a user checks the record, attachments for the specific record are going to be displayed for downloads.
Since they are out of the webroot, I am unable to get them downloaded as they would have a url of
Do we have a solution or should it downloadable folders be child directories of the webroot?
is the code I am using. The folder’s owner is www-data:/ or the web server. So there should be no access issues.
the latter is the least preferable option because it is resource intensive, but sometimes it’s the only alternative. It also needs proper securing to prevent an attacker from getting other files on your server through the proxy.
You can, just have a php file that echos the contents the file to the response, and set the mime-type appropriately.
A nice way to take a load of PHP is with