File manager folder permissions - Apache/PHP

[dog]

I've built a tiny, crappy little file manager where an admin can create a folder, upload files to that folder, and assign a username and password to the folder (php/mysql not htaccess).

To prevent direct browsing access to the folders I've bunged an .htaccess file in the admin-created folders' parent folder, which denies all, but allows localhost access so the PHP script which returns the contents of the folders as links can run.

All fine and dandy, but a user can't view/save the files as it isn't a localhost operation. Seems to me that this would be quite a common issue, but I've yet to find an answer on other forums.

Any ideas?

 

[me]

You need to make your script read the requested file and send its output to the user. That way it's the PHP or webserver process reading the file.

Or it may be ok just to turn autoindex off. That way the password would just allow users access to the directory listing rather than the files themselves.

 

[dog]

I took the folders out of the public folder. Solved the problem.