拒绝直接访问pdf文件，但允许当用户登录

Question

我有一个小问题，我的PHP应用程序，我有一个名为“my_files”里面这个文件夹我有很多目录下的许多pdf。 内部“my_files”目录，我把这个htaccess的行拒绝直接访问形式的URL（工作正常）：

Order Deny,Allow 
Deny from all 

在我的根目录的项目，我把这个PHP文件（get_file.php）只允许PDF下载记录-in成员：

if(!empty($_GET['pdf_name'])) { 
    // check if user is logged  
if(is_user_logged_in()){ 
    $pdf_name = preg_replace('#[^-\w]#', '', $_GET['pdf_name']); 
    $pdf_folder = {$_SERVER['DOCUMENT_ROOT']}/docs/en; 
    $fic = "{$pdf_folder}/{$pdf_name}.pdf"; 
    if(file_exists($fic)){ 
     header('Cache-Control: public'); 
     header('Content-Description: File Transfer');*/ 
     header('Content-Type: application/pdf'); 
     header("Content-Disposition: attachment; filename={$fic}"); 
     header('Content-Transfer-Encoding: binary'); 
     readfile($fic); 
     exit; 
    } 
    } 
} else { 
    die("ERROR: you don't have permissions to download it."); 
} 

当我访问此网址：

myappdomaindotcom/get_file.php?pdf_name=STUDENTS 

浏览器返回：

This web page is not available 
ERR_INVALID_RESPONSE 

有人可以帮我吗？目的是禁止文件直接访问，但只允许登录成员。

UPDATE

在浏览器控制台我得到这样的响应： 为什么我的数据：图像????

UPDATE V2

我改了一下代码以添加引用，但我得到了同样的结果，该文件确实存在，但控制台返回相同的故障状态。

if(!empty($_GET['pdf_name'])) { 
    // check if user is logged  
    if(is_user_logged_in()) { 


    $pdf_name = preg_replace('#[^-\w]#', '', $_GET['pdf_name']); 
    $pdf_folder = "{$_SERVER['DOCUMENT_ROOT']}/docs/en"; 
    $pdf_file = "{$pdf_folder}/{$pdf_name}.pdf"; 
    echo $pdf_file; 
    if(file_exists($pdf_file)) 
    { 

     header('Cache-Control: public'); 
     header('Content-Description: File Transfer'); 
     header('Content-Type: application/pdf'); 
     header("Content-Disposition: attachment; filename={$pdf_file}"); 
     header('Content-Transfer-Encoding: binary'); 
     readfile($pdf_file); 

    } 
    } 
} else { 
    die("ERROR: you don't have permissions to download it."); 
} 

UPDATE V3工作

我终于解决了它从这个帖子：solution，下面是最终代码：

if(!empty($_GET['pdf_name'])) { 

// check if user is logged  
if(is_user_logged_in()) { 

    $proxiedDirectory = "{$_SERVER['DOCUMENT_ROOT']}/xxxx/"; 
    $filename   = $_GET['pdf_name']; 
    $file    = $proxiedDirectory.$filename.'.pdf'; 
    $basename   = basename($file); 

    if(file_exists($file)){ 
     $fp = fopen($file, 'rb'); 

     header("Content-Type: application/pdf", true, 200); //May need to determine mime type somehow 
     header("Content-Disposition: attachment; filename={$basename}"); 
     header('Cache-Control: public'); 
     readfile($file); 
     exit(); 
    } 

} 

} else { die("ERROR: you don't have permissions to download it.");} 

谢谢你的帮助球员，但我有一个最后的问题：是否可以打开PDF而不是下载它？

Answer 1

尝试此代码

误差线这个$ pdf_folder = {$ _SERVER [ 'DOCUMENT_ROOT']} /文档/ EN;不是字符串。

if(!empty($_GET['pdf_name'])) { 
    // check if user is logged  
if(is_user_logged_in()){ 
    $pdf_name = preg_replace('#[^-\w]#', '', $_GET['pdf_name']); 
    $pdf_folder = "{$_SERVER['DOCUMENT_ROOT']}/docs/en"; 
    $fic = "{$pdf_folder}/{$pdf_name}.pdf"; 
    if(file_exists($fic)){ 
     header('Cache-Control: public'); 
     header('Content-Description: File Transfer');*/ 
     header('Content-Type: application/pdf'); 
     header("Content-Disposition: attachment; filename={$fic}"); 
     header('Content-Transfer-Encoding: binary'); 
     readfile($fic); 
     exit; 
    } 
    } 
} else { 
    die("ERROR: you don't have permissions to download it."); 
}