Use htaccess and PHP Sessions to restrict direct access to swf files
I have several flash presentations, which I would like to restrict access
to only logged in users. I have a log in form that sets a session variable
for each presentation that indicates if the logged in user has access to
that particular presentation.
// User's access is stored in DB with other account info, and sessions are
set when logged in
$_SESSION['mfg'] = 'yes';
$_SESSION['product'] = 'no';
In this case the user should be able to access the 'mfg' presentation, but
not the 'product' presentation.
Cookies are also set as follows:
setcookie('mfg', $_SESSION['mfg'], time() + (60 * 60 * 24 * 7));
setcookie('product', $_SESSION['product'], time() + (60 * 60 * 24 * 7));
This works great for direct access to the presentation, as I set an index
file in the /mfg/ directory for example to check if $_SESSION['mfg'] is
set to 'yes'. If it is, the presentation loads, if not the user gets
redirected elsewhere.
The Problem
Regardless of whether or not someone is logged in and the session/cookie
is set to 'yes', if they visit /mfg/swf/slide1.swf directly they can view
the slide in their browser. They can then cycle through the presentation
by visiting /mfg/swf/slide2.swf, etc...
I would like to somehow use an .htaccess file in the /mfg/swf/ folder to
check if $_SESSION['mfg'] (or the cookie 'mfg'??) is set to 'yes'. If it
is, then it should allow the person to view the slides, if not then they
should be redirected to the log in form (/login.php).
The Bigger Problem
I don't really know how to write an htaccess file. I only know that this
is a possibility from a few searches that sounded like they were written
in another language.
No comments:
Post a Comment