如何在Magento2中实现仅管理员可访问媒体图片，其他用户URL访问被拒

Got it, let's work through how to lock down Magento 2 media files exactly as you need—blocking all direct browser access except for admins who can only view them via the backend. Here's a comprehensive, step-by-step solution:

First, we'll configure your web server to deny access to /media/ URLs unless the request comes from a logged-in admin session or the Magento backend itself.

For Nginx Users #

Edit your Magento 2 Nginx configuration file (usually located at /etc/nginx/sites-available/your-magento-site.conf) and add this location block before the existing /media/ rules:

location ~* ^/media/ {
    # Allow access if request originates from Magento admin
    if ($http_referer ~* /admin/) {
        allow all;
    }
    # Allow access if user has an active admin session cookie
    if ($http_cookie ~* "adminhtml=") {
        allow all;
    }
    # Deny all other requests
    deny all;
    # Optional: Return 404 instead of 403 to hide file existence (more secure)
    # return 404;
}

After adding this, reload Nginx with sudo systemctl reload nginx to apply changes.

For Apache Users #

Edit the .htaccess file in your Magento root directory, and add these rewrite rules above the existing media-related rules:

RewriteEngine On
# Allow access from admin referer
RewriteCond %{HTTP_REFERER} ^https?://[^/]+/admin/ [NC]
RewriteRule ^ - [L]
# Allow access if admin session cookie exists
RewriteCond %{HTTP_COOKIE} adminhtml= [NC]
RewriteRule ^ - [L]
# Deny all other requests to media files
RewriteRule ^media/ - [F,L]

Save the file and reload Apache with sudo systemctl reload apache2.

The above server rules block direct access, but we need to make sure admins can't bypass this by copying URLs from the media library. We'll create a custom module to proxy media file requests through an admin-only controller.

Step 1: Create the Custom Module #

Create a module named Vendor_MediaRestriction (replace Vendor with your actual vendor name):

1. Create app/code/Vendor/MediaRestriction/etc/module.xml:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Module/etc/module.xsd">
    <module name="Vendor_MediaRestriction" setup_version="1.0.0">
        <sequence>
            <module name="Magento_Cms"/>
        </sequence>
    </module>
</config>

2. Create app/code/Vendor/MediaRestriction/registration.php:

<?php
use Magento\Framework\Component\ComponentRegistrar;

ComponentRegistrar::register(ComponentRegistrar::MODULE, 'Vendor_MediaRestriction', __DIR__);

Step 2: Create the Admin Controller #

This controller will handle media file requests and only allow access to authorized admins:
Create app/code/Vendor/MediaRestriction/Controller/Adminhtml/Media/View.php:

<?php
namespace Vendor\MediaRestriction\Controller\Adminhtml\Media;

use Magento\Backend\App\Action;
use Magento\Backend\App\Action\Context;
use Magento\Framework\App\Response\Http\FileFactory;
use Magento\Framework\Filesystem\DirectoryList;
use Magento\Framework\Exception\FileSystemException;

class View extends Action
{
    protected $fileFactory;
    protected $directoryList;

    public function __construct(
        Context $context,
        FileFactory $fileFactory,
        DirectoryList $directoryList
    ) {
        $this->fileFactory = $fileFactory;
        $this->directoryList = $directoryList;
        parent::__construct($context);
    }

    public function execute()
    {
        $filePath = $this->getRequest()->getParam('file');
        if (!$filePath) {
            $this->getResponse()->setHttpResponseCode(400);
            return;
        }

        // Sanitize path to prevent directory traversal attacks
        $filePath = ltrim($filePath, '/');
        $mediaDir = $this->directoryList->getPath(DirectoryList::MEDIA);
        $fullPath = $mediaDir . '/' . $filePath;

        try {
            if (!file_exists($fullPath) || !is_file($fullPath)) {
                $this->getResponse()->setHttpResponseCode(404);
                return;
            }
        } catch (FileSystemException $e) {
            $this->getResponse()->setHttpResponseCode(403);
            return;
        }

        // Return the media file to the admin
        return $this->fileFactory->create(
            basename($fullPath),
            ['type' => 'filename', 'value' => $filePath],
            DirectoryList::MEDIA,
            mime_content_type($fullPath),
            null
        );
    }

    protected function _isAllowed()
    {
        // Restrict to users with media gallery access permission
        return $this->_authorization->isAllowed('Magento_Cms::media_gallery');
    }
}

Step 3: Configure Admin Route #

Create app/code/Vendor/MediaRestriction/etc/adminhtml/routes.xml:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd">
    <router id="adminhtml">
        <route id="vendor_media_restriction" frontName="vendor_media_restriction">
            <module name="Vendor_MediaRestriction" />
        </route>
    </router>
</config>

Step 4: Modify Media Library URLs to Use the Controller #

We'll use a plugin to replace direct media URLs in the backend with our controller's URL:

1. Create app/code/Vendor/MediaRestriction/etc/adminhtml/di.xml:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <type name="Magento\Cms\Model\Wysiwyg\Images\Storage">
        <plugin name="vendor_media_restriction_modify_file_url" type="Vendor\MediaRestriction\Plugin\ModifyFileUrl" />
    </type>
</config>

2. Create app/code/Vendor/MediaRestriction/Plugin/ModifyFileUrl.php:

<?php
namespace Vendor\MediaRestriction\Plugin;

use Magento\Cms\Model\Wysiwyg\Images\Storage;
use Magento\Backend\Helper\Data as BackendHelper;

class ModifyFileUrl
{
    protected $backendHelper;

    public function __construct(BackendHelper $backendHelper)
    {
        $this->backendHelper = $backendHelper;
    }

    public function afterGetFileUrl(Storage $subject, $result)
    {
        // Replace direct media URL with our admin controller URL
        $mediaBaseUrl = $subject->getBaseUrl();
        $relativeFilePath = str_replace($mediaBaseUrl, '', $result);
        return $this->backendHelper->getUrl('vendor_media_restriction/media/view', ['file' => $relativeFilePath]);
    }
}

Step 5: Enable the Module #

Run these commands in your Magento root directory:

bin/magento module:enable Vendor_MediaRestriction
bin/magento setup:upgrade
bin/magento cache:flush

• Anonymous/Non-Admin Access: Open a private browser window and try to access any /media/ URL (e.g., https://your-site.com/media/catalog/product/1/2/123.jpg). You should get a 403 or 404 error.
• Admin Access: Log into the Magento backend, navigate to Content > Media Gallery. Images should load normally. Copy an image URL from the media library and try to open it in a private window—it should be blocked.

内容的提问来源于stack exchange，提问作者Ankit