如何保证安全

[wjx2003]

需要密码才能下载的文档，安全性不能保证，因为可以 直接到./UPLOADS下面去下载，绕开密码。

[Andrew::]

是可以直接下載沒錯, 但是你要先知道檔案名稱.
檔案名稱是只有上傳的人知道, 沒辦法從其他地方得到, 官方沒做其它保護應該是這個原因吧.
我在到官網問問看

[Andrew::]

前端上傳會將檔案改名, 所以要知道檔案名稱很難.
管理員上傳就不會, 會再建議關方.

還有你可以用 .htaccess 來保護上傳的目錄.

[wjx2003]

谢谢，

[Andrew::]

官方提供的, 讓管理員上傳的檔案也會被改名
打開 modules/admin/files_add_file.php
尋找:

程式碼:

// It's like finding a needle in a haystack...
 if (in_array($ext, $allowed_ext) || !($site_config['acp_check_extensions']))
 {
  if (move_uploaded_file($_FILES['uploadfile']['tmp_name'], './uploads/'.basename($_FILES['uploadfile']['name'])))
  {

覆蓋:

程式碼:

// It's like finding a needle in a haystack...
 if (in_array($ext, $allowed_ext) || !($site_config['acp_check_extensions']))
 {
  $time = time();
 
  if (move_uploaded_file($_FILES['uploadfile']['tmp_name'], './uploads/upload-'.$time.'-'.basename($_FILES['uploadfile']['name'])))
  {

尋找:

程式碼:

     // File was uploaded successfully - add as a mirror
     $dbim->query('INSERT INTO '.DB_PREFIX.'mirrors
       SET file_id = '.$_REQUEST['file_id'].',
        name = "Mirror 1",
        location = "Earth",
        url = "'.$site_config['url'].'uploads/'.basename($_FILES['uploadfile']['name']).'"');
   
     $filesize = filesize('./uploads/'.basename($_FILES['uploadfile']['name']));
     
   // Set file active
   $dbim->query('UPDATE '.DB_PREFIX.'files
       SET status = 1,
        size = '.$filesize.'
       WHERE (id = '.$_REQUEST['file_id'].')');

覆蓋:

程式碼:

     // File was uploaded successfully - add as a mirror
     $dbim->query('INSERT INTO '.DB_PREFIX.'mirrors
       SET file_id = '.$_REQUEST['file_id'].',
        name = "Mirror 1",
        location = "Earth",
        url = "'.$site_config['url'].'uploads/upload-'.$time.'-'.basename($_FILES['uploadfile']['name']).'"');
   
     $filesize = filesize('./uploads/upload-'.$time.'-'.basename($_FILES['uploadfile']['name']));
     
   // Set file active
   $dbim->query('UPDATE '.DB_PREFIX.'files
       SET status = 1,
        size = '.$filesize.'
       WHERE (id = '.$_REQUEST['file_id'].')');

[wjx2003]

不错，设定htaccess,ok,uploads就保护起来了。谢谢！