Protecting downloads...

Hi there,

Just wondering if anyone knows of a way to protect files in the the assets/files/ from direct access?
I have seen snippets that offer the ability to show the user a different url, however this does not really protect the files from direct access?

I only want authenticated web users to be able to download files?

Cheers,

J

Try this
http://modxcms.com/extras/package/148

In combination with webusers.

Greetz
JUSI

This still isn’t what I have in mind.
I want manager users to be able to copy files up using the resource browser, and be happy they are in a folder that is not accessible to the public.

To put the files outside the web root would mean that the manager can’t access them?

I have not tried this but I think it should be possible to use the plugin with a folder in the webroot which is .htaccess protected to disallow direct access.
The plugin accesses the files direct and routes them thru a php script. Therefore this might work and manager users can upload files using filemanager.

Greetz
JUSI

Quote from: jusicgn at Sep 18, 2009, 06:06 AM

I have not tried this but I think it should be possible to use the plugin with a folder in the webroot which is .htaccess protected to disallow direct access.

How can you disallow direct acesss, but still allow php to access?
My first though was to route all requests for assets/files/ to a php file that checks the login, and then serves the file....but my fear is that PHP will be stopped by the same safegaurd used above?

Tried it, and it works! (Using this plugin for my protected customer section.)

Just cerate a folder i.e. inside assets and protect it via a .htaccess file with the following content:


The plugin can still read the contents of the folder and displaying the files to the logged in user.
Also downloading the files via the plugin works fine for me.

Greetz
JUSI

which snippet are you using to download?
I used FileDownload, and all it is doing is providing me with a link to the file??!?

I want the download to fire automatically if the user is ok?

I’m using FileDownload plugin with FileDownload snippet.

My scenario may differ from yours:
My customers are provided with a login which allows them to login on my homepage and then get displayed all the files I’ve put in their respective folder.

If I’m getting you right, you just want your users to login if they click on a download link but have the files displayed even if the users is not logged in?

I think this should be also possible with the snippet. Have a look at the "Permissions" section at
http://www.muddydogpaws.com/development/filedownload/parameters.html

If I’m right, you can specify to display the files but only allow logged in users to download them...

Greetz
JUSI

Got it working, bit of a work around but "it works"
OK so I have this in the .htaccess file in /assets/files/:

RewriteEngine on
RewriteRule (.*) index.php?id=10&file=$1

In the document with ID 10 I basically copied the code from the FileDownloadPlugin here: http://modxcms.com/extras/download/251/251

I set the var:

$file = $_GET[’file’];
$downloadFile = ’/home/usr/pathtofile/’.$file;

Just wrap the code is:

if($modx->getLoginUserID())
{
PLUGIN CODE
}

Thats al I did, working fine. Can anyone see a security problem with this?