Allowing only registered users access to documents such as PDFs

I’ve check the forums, but can’t find a topic that covers my question.

I have a site that requires users to login to see news items. Some of those items contain links to PDFs that have been uploaded to the server (with 755 permissions).

At the moment, a registered user can copy the link and paste it publicly and then anyone can access that file directly.

Links to these files should only work for registered users. Is this possible?

The best way to deal with this would be to make these .pdf files be BLOB objects in the database, and use a snippet to make them available for download.

Thanks Susan. Is there any other way? The site is live and there are already hundreds of news items containing links to these PDFs, and the journalists have only just become familiar with uploading to the fileserver etc. Ideally, I need to keep the file structure in place as it currently stands.

The only way to directly protect files is to add Apache-level password protection to the directory, which of course will be very inconvenient for the visitors.

So does everyone who has files protected behind a user login have to store them in the database to prevent public access?

Is 755 the best Unix setup? Should I change the directory to something more secure or will that prevent the uploaders from being able to see the structure?