This is how I implement this with CakePHP and it works well. First, I make sure the application code is located above the public html directory so that it is not open to the Internet. Thus, basically, the only files that users have direct access to are index.php file, css / js and image files.
:
function beforeSave() {
extract($this->data['Upload']['file']);
if(isset($name) and !empty($name)) {
$filename = time().'-'.$name;
if ($size && !$error) {
move_uploaded_file($tmp_name, APP . 'media/files/' . $filename);
$this->data['Upload']['file'] = $filename;
$this->data['Upload']['name'] = $name;
$this->data['Upload']['file_type'] = $type;
}
} else {
unset($this->data['Upload']['file']);
}
return parent::beforeSave();
}
function beforeDelete() {
$data = $this->read(null, $this->id);
if( is_file( APP . 'media/files/' . $data['Upload']['file'])) {
unlink(APP . 'media/files/' . $data['Upload']['file']);
}
return true;
}
. // , . , , , -.
, , , "shareable", , , .