can you guys help me?

Thomas J. O'Hara

Thomas J. O'Hara

Senior Citizen
I'm trying to figure out how to make my movies directory "forbidden"

for example, I would post a link to a mov file here, and you would open it in your browser to stream...but if you wanted to see more, all you have to do is go to the root directory and then it will show all the files I have on there.

But I don't want people to have access to every file, just the one I post...so how do I make it so they can't get into my other directories?
 
First off, where are you hosting the files? Particularly, is it an Apache-driven server?
You can set up the access permissions through the .htaccess file (linux is so awesome =).
 
Even easier: drop a file called index.html (see below) into the same directory as your files. It doesn't even have to have anything in it.


This is below. -> or index.htm, default.htm, or whatever else your system takes as a default index filename.
 
With most FTP and SSH access to the server you can right click on the directory in question (from the next level up) and set the permissions from there. You want the directory to be publically "excecutable" (so they can open files from within) but NOT "readable" so they can't just read the open directory.

Or much simpler, just drop in an index.html file and 99% of the time that will show instead of the directory contents. This is what I did to "pookieproof" one of my folders: http://mikko.n3.net/dvxuser/ :laugh:


EDIT: D'oh! GenJerDan beat me to it!


- Mikko
 
Last edited:
Uh, dropping an index page into the directory does not protect the other files in that directory. People will still be able to type in the names of those other files, and get them. If that is not a concern, okay.

But if it is, in general, unless you are going to apply some kind of auth, any files in the doc root are available to the world.

Also, setting the file permissions on the file system has nothing to do with this whatsoever. The most you will accomplish with that is making it so that the WEBSERVER cannot read the files. But those permissions you see via ssh and ftp have NOTHING to do with restricting access to users through the web server.

Basically, the bottom line is, if you really don't want a file available to the world, do not put it in the doc root. Period. If the security-by-obscurity approach of putting the index page there is sufficient for you, fine, but be aware that your files are in no way protected at all.

Wow, sorry for the long-winded post. Can you tell what I do for a living? :)
 
I just wanted to be able to show specific files without people being able to browse through them for themselves. the read/execute combo worked perfectly!
 
desperatecomfort said:
Uh, dropping an index page into the directory does not protect the other files in that directory. People will still be able to type in the names of those other files, and get them.
Click to expand...

Well, only if they have magic eyes and can see what the names are despite them not being displayed. ;-)
 
If you have a .htaccess file in your root directory add this line :

Options -Indexes

If you don't have a .htaccess file just create it, if you're apache powered.

http://www.modwest.com/help/kb1-53.html

Last byte .htaccess chmod permissions must be at
4 (644, 604, 605, 705, 775, etc) (common value is 644)

Btw, msnbot is very aggressive these last days. For 2 weeks now, this f***ing bot is loading all the pictures of a directory at least twice a day and eating my bandwith for nothing. And the worst, it is that even with some instructions in the robots.txt it still goes on.

This is the only bot doing that...

I'm not alone : http://drupal.org/node/55158
 
Last edited:
You must log in or register to reply here.
Back
Top