Skip to main content

Storage folder and self-test

WirdAll synchronisiertfiles …lie in a storage folder. No download is handed out through the address of its file, but always through Fileshelf: Fileshelf first checks whether the visitor may get the file, then counts the download and sends the file. So that this cannot be bypassed, the folder must be locked against direct access.

The self-test

The dashboard checks the folder itself: Fileshelf places a test file and tries to fetch it through its address. The result comes in three colours:

ResultMeaning GreenProtected: the files cannot be reached by their address, or the folder lies outside the web directory. RedNot protected: files can be downloaded past protection and counter. The dashboard shows how to close the folder. YellowNot testable: the website did not answer the test request. Check again later.

Check now repeats the test, for example after you changed the server configuration.

Apache

Fileshelf places an .htaccess file into the folder. If the test stays red, your server does not allow .htaccess files. Ask your host to allow AllowOverride for this folder.

nginx

nginx does not read .htaccess files. Add the rule the dashboard shows to the server configuration (through your host if need be). For the default folder it reads:

location ^~ /fileshelf/ { deny all; }

Outside the web directory

Safest is a folder that has no address at all. Enter an absolute path outside the web directory under Options → Storage → Storage folder, for example /home/customer/fileshelf. Existing files are not moved when you change it – copy them into the new folder yourself.

A menu item with the same alias as the storage folder (such as fileshelf) would be locked together with the folder. The dashboard warns in this case; give the menu item another alias.

Delivery by the web server

Under Options → Storage → Delivery you can let the web server send the file instead of PHP: X-Sendfile (Apache with mod_xsendfile) or X-Accel-Redirect (nginx with an internal address). Only choose this if your host has set it up; when in doubt, keep PHP. Protection and counter apply in all three cases.

Deutsche Fassung