Selective permission to upload files using Apache and PHP

Question

I have a site with the ability to upload files. However, not everyone is allowed to download every file. For example, if I log in as an administrator, I can upload all the files, but if I log in as a client, I can upload only certain files.

Currently, all these files are stored in a directory outside the root directory, so users cannot download them manually. I created a PHP script to control file uploads, but this is very bad. I have tried several things:

1

echo file_get_contents($file);

2:

readfile($file);

3:

if (($handle = fopen($file, "rb")) !== false)
{
  while (!feof($handle))
  {
    echo fread($handle, 4096);
  }
  fclose($handle);
}

, 500 . . , 80%. - .

. Firefox ( , 700 /, localhost readfile 25 /, ) Chrome, Internet Explorer . IE " ", "/". , "/".

, , . , Apache , . , .

? ?

Answer 1

1) 2) , script . 32 64 , - .

, script; content-type content-length.

PHP, , , , , X-Sendfile.

Answer 2

, PHP, :

header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="example.zip"'); 
header('Content-Transfer-Encoding: binary');

http://www.jonasjohn.de/snippets/php/headers.htm

iFrame, ... .

:

http://w-shadow.com/blog/2007/08/12/how-to-force-file-download-with-php/