php 如何密码保护网站中可下载的pdf文件
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/13146450/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
how to password protect downloadable pdf files in website
提问by D3vil_Mind
I am having a personal portfolio website and i have a some pdf files like
我有一个个人作品集网站，我有一些 pdf 文件，例如
<a href="file.pdf">Some file</a>
I dont want everyone to download the file, and i want it to protect it with password,so that i can share it with only the people i know
我不希望每个人都下载文件，我希望它用密码保护它，这样我就可以只与我认识的人共享它
where only the person who gives the correct password is able to download my file
只有提供正确密码的人才能下载我的文件
Note: 1. since its a personal portfolio website it do not have any "LOGIN's"
2. I have designed the webpage with HTML as a responsive code
注意：1. 因为它是一个个人投资组合网站，所以它没有任何“登录”
2. 我用 HTML 设计了网页作为响应代码
Your suggestions please, any way of doing it without .htaccess ??
请您提出建议，没有 .htaccess 的任何方法？
采纳答案by rws907
Use MySQL or MySQLite - depending on your preference - and store the link to the PDF in the database. Then use a script such as download.php. Store a password for the file in the database and require the user to enter it before the file is downloaded. If you're unfamiliar with databases you COULD do it all in PHP.
使用 MySQL 或 MySQLite - 根据您的偏好 - 并将 PDF 链接存储在数据库中。然后使用诸如download.php 之类的脚本。在数据库中存储文件的密码，并要求用户在下载文件之前输入密码。如果你不熟悉数据库，你可以用 PHP 来做这一切。
A VERY rough mockup (Without a database, if you are familiar with dbs, adjust accordingly)
一个非常粗略的模型（没有数据库，如果你熟悉dbs，请相应调整）
HTML Form
HTML 表单
<form name="download" id="download" method="post" action="download.php">
<input type="password" id="password" name="password" />
<input type="submit" id="submit" value="Download" />
</form>
PHP (download.php)
PHP (下载.php)
<?php
// Get the password
$pw = md5($_POST['password']);
// Compare against the stored password
$valid_pw = md5("your password you want to use");
if($pw != $valid_pw){
echo "Error! You do not have access to this file";
}else{
header("Location: /path/to/your/file.pdf");
}
?>
NOTES:
笔记：
I used an extremely basic method of encrypting the password. I would research better methods if this was my application but for the sake of brevity and ease of understanding, I used a simple md5()hash comparison.
我使用了一种非常基本的密码加密方法。如果这是我的应用程序，我会研究更好的方法，但为了简洁和易于理解，我使用了一个简单的md5()哈希比较。
回答by HenchHacker
You need to use a php file to feed the file through where the pdf files are stored in a NON PUBLIC folder.
您需要使用 php 文件通过 pdf 文件存储在非公开文件夹中的位置来提供文件。
For example, put your pdfs in a non public accessible directory, let's say: /home/pdfs/
例如，将您的 pdf 文件放在一个非公开可访问的目录中，例如：/home/pdfs/
And your PHP script in a public accessble directory, let's say: /home/public_html/
并且您的 PHP 脚本位于公共可访问目录中，例如：/home/public_html/
Inside the script in the public directory put:
在公共目录中的脚本中放置：
if (isset($_GET('password')) {
die('wrong password');
}
if ($_GET['password'] != 'mypass') {
die('wrong password');
}
$file="/home/pdfs/test.pdf";
header("Pragma: public");
header('Content-disposition: attachment; filename='.$file);
header("Content-type: ".mime_content_type($file));
header('Content-Transfer-Encoding: binary');
ob_clean();
flush();
readfile($file);
Use GET values to determine the file to download, but to ensure better security only allow .pdf extensions, strip all other periods and slashes to prevent them from traversing the directories of your server and being given important security files containing passwords etc!!! To be even safer still only name your pdf files using characters a-z 0-9 and - or _
使用 GET 值来确定要下载的文件，但为了确保更好的安全性，只允许 .pdf 扩展名，去除所有其他句点和斜杠，以防止它们遍历您的服务器目录并获得包含密码等的重要安全文件！！！为了更安全，仍然只使用字符 az 0-9 和 - 或 _ 命名您的 pdf 文件
And then when you wish to download a file craft the correct URL to the script above, and ensure the pdf file exists in the non public directory.
然后，当您希望下载文件时，请为上面的脚本制作正确的 URL，并确保 pdf 文件存在于非公共目录中。
回答by CodeAngry
Follow @rsmith84'stips but make sure you block folder access:
遵循@rsmith84 的提示，但请确保阻止文件夹访问：
Apache.htaccess file
Apache.htaccess 文件
Deny from all
IISweb.config file
IISweb.config 文件
<system.webServer>
<security>
<authorization>
<remove users="*" roles="" verbs="" />
<add accessType="Allow" roles="Administrators" />
</authorization>
</security>
</system.webServer>
Thenh allow delivery only with a PHP file. Verify user and then do readfile('/protectd/file/path')from your protected folder.
然后只允许使用 PHP 文件进行交付。验证用户，然后readfile('/protectd/file/path')从受保护的文件夹中执行。
回答by Omid Kamangar
Create a php file say, download.phpand link to that file instead.
You can check for correct password there, and if it's correct, you can write the contents of the PDF file to the response.
创建一个 php 文件，download.php然后链接到该文件。
您可以在那里检查正确的密码，如果正确，您可以将 PDF 文件的内容写入响应。
