How secure is a PDF on the server?

139 Posts

Darkelve Reply #1, 16 years, 7 months ago

I’ve made a protected page containing a list of PDFs, reachable through a simple login page. However I was wondering how secure this really is, since if you enter the full path to the PDF on the server - e.g. mysite.com/assets/files/topsecret.pdf - I do not think it’s very protected, is it?

Perhaps it would be a good idea to put the PDF in a folder that’s hard to guess, e.g. mysite.com/assets/d4531dadf/topsecret.pdf. Or can the webserver still be scanned for existing folders and documents?

I’m wondering how one would go about protecting such documents.

168 Posts

pixelstation Reply #2, 16 years, 7 months ago

I would recommend a php file that does the following:

1. Check to make sure a user is logged in (are all PDFs available to all users by the way?)
2. If user is logged in, send the PDf file but sent it through php with the relevant headers so you have to change your URLs from ’mysite.com/assets/files/topsecret.pdf’ to ’mysite.com/assets/php/download.php?file=topsecret.pdf’

Note that you have to put in these four lines in your download.php:


include_once "../manager/includes/config.inc.php";
startCMSSession();
include_once($base_path."/manager/includes/document.parser.class.inc.php");
$modx = new DocumentParser;

then something like

$filename = '/fullpathtofile/'.$_GET['file'];


if (userisnotloggedin) {
    echo '403 Access Denied';
    exit(0);

} else {

    header("Content-disposition: attachment; filename=\"{$_GET['file']}\"");
    header("Content-type: application/octet-stream");
    header('Content-Transfer-Encoding: binary');
    header('Content-Length: '.filesize($filename));
    readfile($filename);

    exit(0);

}

97 Posts

jamesehly Reply #3, 16 years, 6 months ago

Quote from: Darkelve at Mar 10, 2010, 08:31 AM

I’ve made a protected page containing a list of PDFs, reachable through a simple login page. However I was wondering how secure this really is, since if you enter the full path to the PDF on the server - e.g. mysite.com/assets/files/topsecret.pdf - I do not think it’s very protected, is it?

Perhaps it would be a good idea to put the PDF in a folder that’s hard to guess, e.g. mysite.com/assets/d4531dadf/topsecret.pdf. Or can the webserver still be scanned for existing folders and documents?

I’m wondering how one would go about protecting such documents.

You’re right, it’s not very protected. Google has a knack for finding things you don’t want to be found. The method above by pixelstation is good and you’ll want to store your PDFs outside of the web root, or disallow web access if it is in a web folder.

James

DEVTRENCH: web development blog :: EHLY DESIGN

2,877 Posts

mrhaw Reply #4, 16 years, 6 months ago

There is also this one:
http://modx.scottydelicious.com/blog/2008/06/15/filedownloadpe
http://modxcms.com/forums/index.php/topic,26595.80.html
// haven’t used it myself.

If it’s very sensitive information maybe use .htpasswd protection
instead.

@hawproductions | http://mrhaw.com/

Infograph: MODX Advanced Install in 7 steps:
http://forums.modx.com/thread/96954/infograph-modx-advanced-install-in-7-steps

Recap: Portland, OR (PDX) MODX CMS Meetup, Oct 6, 2015. US Bancorp Tower
http://mrhaw.com/modx_portland_oregon_pdx_modx_cms_meetup_oct_2015_us_bancorp_tower

☆ A M B ☆
24,524 Posts

sottwell Reply #5, 16 years, 6 months ago

I would add that if it’s all that sensitive, what’s it doing on a web server in the first place?

HTTP and FTP was designed to facilitate communication and the transmission of information in various forms; it was never designed to be secure. That’s what encrypted VPNs, SFTP, SSH or dedicated private lines are for.

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org