I want to create cloud storage platform that users can uploads any kind of files and download them.But I want to be sure that none will enter another people files thats why I think I need to deny people to access with chmod but It seems that if I give 600 permission to the file php also will be denied.How can I do this?


I want to use file permissions because in the file system I cannot trust filename.For example when I store user's files I create folder which named with random numbers but there are also security risk because if I do it and if someone guess users' file name he can access another people files which is extremely bad for cloud storage system

closed as too broad by Steffen Ullrich, Xiong Chiamiov, S.L. Barth, Polynomial, tim Jan 1 '17 at 20:21

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Ok. First of all: that is a complex system you're trying to build, and you don't even seem to have looked into existing solutions to figure out how you'd do that. Then: this is a development question with a million possible answers, so it's totally off-topic and underdefined. – Marcus Müller Jan 1 '17 at 18:48
  • 1
    you appear to be assuming that you will be storing files on the server's file system using the server's own authentication mechanism - there is no reason to do that - apply the business logic in your application – schroeder Jan 1 '17 at 18:53
  • @schroeder okay is there any other way that users will not see each other files?is secury enough random filename?I want to only make accessible file when php require it to access – Alex Jan 1 '17 at 19:09
  • you need to implement an authentication system ... – schroeder Jan 1 '17 at 19:12
  • @Alex, Perhaps you could describe your proposed system a little better, some design docs / diagrams would help prevent this question from being killed. – Jedi Jan 1 '17 at 19:20

That's quite simple, you just need a joint table in your db that tells which files belong to which users, and code the corresponding business logic in your application.

Yes, with ACLs you could in theory make it work as you wanted, but creating OS users for everyone would be a way higher security risk.

  • But I cannot store these files in the database,If I do I have to deal with Blobs.On other hand we have file system.In the file system I cannot trust filename.For example when I store user's files I create folder which named with random numbers but there are also security risk because if I do it and if someone found users' file name he can access another people files – Alex Jan 2 '17 at 1:04
  • You don't need to store any files in the database. There is the interface a user uses, he sees their own files. How? You list them after a query like SELECT * FROM userfiles WHERE user_id = 8. You can store absolute paths, or whatever to identify the file. On the download page, user wants to access the file, you write a condition (if statement), if the user_id is 8, or whatever it is, you serve the download. If not, you wont. That simple. Pointing out that user is an application user, which is in your users table, not OS user. Google is your friend, but if you're unsure what to do I can link – Rápli András Jan 2 '17 at 2:13
  • No actual problem is how to store these files.With a random name right?and I store this name (path) in the database but what about someone came and searched. Another people file and he try to gues filename and found it?He will get access to another people file.For example A user upload file to server,and I store it in public/files/users/randomname1938482pi2i3i43o2 and B user came and want to get access to someone file and he try combinations in public/files/users/ and suddenly he found A user's real file name,so he will be able to see A person's file. – Alex Jan 2 '17 at 2:33
  • It simply does not matter. They will never get a directory listing. If talking about a webserver for example, put a Deny from all directive on that directory. Filenames don't matter as when you actually serve the download, you can change it to any name. They will never figure out what's the original filename. – Rápli András Jan 2 '17 at 2:42
  • You query the list of files from the database so that the user can't change it. select * from files where userid=".$username.";" Now user B will never see user A files because the select statement blocks it. – cybernard Jan 2 '17 at 2:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.