Allow users to download files outside webroot

Use

  • a symlink pointing to /var/uploads (tutorial here)

  • a Apache Alias directive Alias /uploads /var/uploads (must be in httpd.conf)

  • or a proxy PHP script that accepts a GET variable filename=upload.jpg and fetches the file e.g. using fpassthru()

the latter is the least preferable option because it is resource intensive, but sometimes it’s the only alternative. It also needs proper securing to prevent an attacker from getting other files on your server through the proxy.

Leave a Comment