Laravel 5.0如何渲染非public目录下的PDF文件？

Alright, let's tackle this Laravel 5.0-specific problem since the newer response()->file() helper wasn't available back then. Here's a secure, step-by-step solution to serve your PDFs from the storage directory after running your validation checks:

1. Set Up Your File Structure #

First, place your PDF files in a dedicated subfolder within storage—something like storage/app/pdfs/ (create this folder if it doesn't exist yet). Keeping files organized here makes it easier to manage access.

2. Build the Controller Method with Validation #

In your controller (let's say PdfController), create a method that first runs your required validation (like user authorization, file existence checks) then manually constructs the response to render the PDF.

Here's a complete example:

<?php

namespace App\Http\Controllers;

use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\File;
use Illuminate\Support\Facades\Response;

class PdfController extends Controller
{
    public function viewPdf($filename)
    {
        // --- Step 1: Run your validation checks ---
        // Example 1: Ensure the user is authenticated
        if (!Auth::check()) {
            abort(403, 'You need to be logged in to access this file.');
        }

        // Example 2: Sanitize the filename to prevent directory traversal attacks
        $safeFilename = basename($filename);
        $filePath = storage_path('app/pdfs/' . $safeFilename);

        // Example 3: Check if the file actually exists
        if (!File::exists($filePath)) {
            abort(404, 'The requested PDF could not be found.');
        }

        // --- Step 2: Prepare the response headers for PDF rendering ---
        $headers = [
            'Content-Type' => 'application/pdf',
            // Use "inline" to render in the browser; use "attachment" to force download
            'Content-Disposition' => 'inline; filename="' . $safeFilename . '"',
        ];

        // --- Step 3: Read the file and return the response ---
        return Response::make(file_get_contents($filePath), 200, $headers);
    }
}

3. Add a Route #

Link your controller method to a route so users can access the PDF via a URL:

// routes.php
Route::get('/documents/{filename}', 'PdfController@viewPdf');

Key Tips for Security & Functionality #

• Directory Traversal Protection: Using basename($filename) ensures malicious users can't sneak in paths like ../secret-document.pdf to access files outside your target folder. Always sanitize user-provided filenames!
• Content-Disposition: Switch inline to attachment in the headers if you want to force the browser to download the PDF instead of rendering it.
• File Facade: Don't forget to import the File facade at the top of your controller—otherwise, File::exists() won't work.

This approach works perfectly for Laravel 5.0, letting you securely serve files from outside the public directory after your custom validation logic runs.

内容的提问来源于stack exchange，提问作者Sampudon