StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
primarykey
Id
17347217
data
AcceptedAnswerId
0
AnswerCount
0
ClosedDate
CommentCount
0
CommunityOwnedDate
CreationDate
2013-06-27T15:26:35.693
FavoriteCount
0
LastActivityDate
2013-06-28T08:39:54.067
LastEditDate
2013-06-28T08:39:54.067
LastEditorUserId
1226894
OwnerUserId
1226894
ParentId
17166021
PostTypeId
2
Score
1
ViewCount
0
LastEditorDisplayName
text
Body
Introduction You can use 2 simple method <ul> <li>Authentication Token </li> <li>Signed Request </li> </ul> You can also combine both of them by using Token for authentication and using signature to verify integrity of the message sent Authentication Token If you are going to consider matching any identification in the database perhaps you can consider creating authentication token rather than user ID, session, cookies, ip, time stamp, etc! as suggested. Create a random token and save to Database <pre><code>$token = bin2hex(mcrypt_create_iv(64, MCRYPT_DEV_URANDOM)); </code></pre> <ul> <li>This can be easily generated</li> <li>You can guaranteed it more difficult to guess unlike password </li> <li>It can easily be deleted if compromised and re generate another key </li> </ul> Signed Request The concept is simple, For each file uploaded must meat a specific signature crated using a random generated key just like the token for each specific user This can easily be implemented with HMAC with <code>hash_hmac_file</code> function Combine Both Authentication & Signed Request Here is a simple Prof of concept Server 1 <pre><code>/** * This should be stored securly * Only known to User * Unique to each User * Eg : mcrypt_create_iv(32, MCRYPT_DEV_URANDOM); */ $key = "d767d183315656d90cce5c8a316c596c971246fbc48d70f06f94177f6b5d7174"; $token = "3380cb5229d4737ebe8e92c1c2a90542e46ce288901da80fe8d8c456bace2a9e"; $url = "http://server 2/run.php"; // Start File Upload Manager $request = new FileManager($key, $token); // Send Multiple Files $responce = $request->send($url, [ "file1" => __DIR__ . "/a.png", "file2" => __DIR__ . "/b.css" ]); // Decode Responce $json = json_decode($responce->data, true); // Output Information foreach($json as $file) { printf("%s - %s \n", $file['name'], $file['msg']); } </code></pre> Output <pre><code>temp\14-a.png - OK temp\14-b.css - OK </code></pre> Server 2 <pre><code>// Where to store the files $tmpDir = __DIR__ . "/temp"; try { $file = new FileManager($key, $token); echo json_encode($file->recive($tmpDir), 128); } catch (Exception $e) { echo json_encode([ [ "name" => "Execption", "msg" => $e->getMessage(), "status" => 0 ] ], 128); } </code></pre> Class Used <pre><code>class FileManager { private $key; function __construct($key, $token) { $this->key = $key; $this->token = $token; } function send($url, $files) { $post = []; // Convert to array fromat $files = is_array($files) ? $files : [ $files ]; // Build Post Request foreach($files as $name => $file) { $file = realpath($file); if (! (is_file($file) || is_readable($file))) { throw new InvalidArgumentException("Invalid File"); } // Add File $post[$name] = "@" . $file; // Sign File $post[$name . "-sign"] = $this->sign($file); } // Start Curl ; $ch = curl_init($url); $options = [ CURLOPT_HTTPHEADER => [ "X-TOKEN:" . $this->token ], CURLOPT_RETURNTRANSFER => 1, CURLOPT_POST => count($post), CURLOPT_POSTFIELDS => $post ]; curl_setopt_array($ch, $options); // Get Responce $responce = [ "data" => curl_exec($ch), "error" => curl_error($ch), "error" => curl_errno($ch), "info" => curl_getinfo($ch) ]; curl_close($ch); return (object) $responce; } function recive($dir) { if (! isset($_SERVER['HTTP_X_TOKEN'])) { throw new ErrorException("Missing Security Token"); } if ($_SERVER['HTTP_X_TOKEN'] !== $this->token) { throw new ErrorException("Invalid Security Token"); } if (! isset($_FILES)) { throw new ErrorException("File was not uploaded"); } $responce = []; foreach($_FILES as $name => $file) { $responce[$name]['status'] = 0; // check if file is uploaded if ($file['error'] == UPLOAD_ERR_OK) { // Check for signatire if (isset($_POST[$name . '-sign']) && $_POST[$name . '-sign'] === $this->sign($file['tmp_name'])) { $path = $dir . DIRECTORY_SEPARATOR . $file['name']; $x = 0; while(file_exists($path)) { $x ++; $path = $dir . DIRECTORY_SEPARATOR . $x . "-" . $file['name']; } // Move File to temp folder move_uploaded_file($file['tmp_name'], $path); $responce[$name]['name'] = $path; $responce[$name]['sign'] = $_POST[$name . '-sign']; $responce[$name]['status'] = 1; $responce[$name]['msg'] = "OK"; } else { $responce[$name]['msg'] = sprintf("Invalid File Signature"); } } else { $responce[$name]['msg'] = sprintf("Upload Error : %s" . $file['error']); } } return $responce; } private function sign($file) { return hash_hmac_file("sha256", $file, $this->key); } } </code></pre> Other things to consider For better security you can consider the follow <ul> <li>IP Lock down </li> <li>File Size Limit </li> <li>File Type Validation </li> <li>Public-Key Cryptography </li> <li>Changing Date Based token generation</li> </ul> Conclusion The sample class can be extended in so many ways and rather than use URL you can consider a proper <code>json RCP</code> solution
Tags
Title
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. POGood method to authenticate files to users
 singulars
 PostTypePostTypeId
 PTQuestion
PostTypePostTypeId
1. PTAnswer
UserLastEditorUserId
1. USBaba
UserOwnerUserId
1. USBaba
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. POGood method to authenticate files to users
 singulars
 PostTypePostTypeId
 PTQuestion
PostsParentIdCreationDate
1. This table or related slice is empty.
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
2. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTAcceptedByOriginator
CommentsPostId
1. This table or related slice is empty.

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.