Hi everybody,
I am definitely not a PHP coder, i think my code must be corrected, be free to correct me (so I could learn from my mitsake). I don’t known if my code is secured 
Here is my really first draft of the implementation of mod_auth_token. This module permits you to have unique link for your file. Here are the requirements :
- Access to the httpd.conf from your Apache Distrib
- Compiling and activating the mod_auth_token
With this plugin you can
- define the timeout of your links (globally)
- secure one link in your page
Todo :
Secured multiple files inside a page
I repeat, I am not a PHP Coder, so forgive me if my code is not clear.
Let’s begin :
1) Download & Compile & Activate the mod_auth package from here :
http://code.google.com/p/mod-auth-token/
2) In your httpd.conf (backup befor all) be sure to add the following informations :
<Location /assets/files/>
AuthTokenSecret "nvE7vp2yWWuine1a1EvV"
AuthTokenPrefix "/assets/files/"
AuthTokenTimeout 900
</Location>
Save & Restart your Apache 2 daemon
In your modx root, goto in the assets subfolder and create a new directory called files, then put a test file (for me it will be modx.zip)
In modx Revo 2, create a new plugin "SecureDownloadHandler"
copy/paste into your new plugin :
<?php
if ($modx->event->name === 'OnWebPagePrerender') {
$secret = "nvE7vp2yWWuine1a1EvV"; // Same as AuthTokenSecret
$protectedPath = "/assets/files/"; // Same as AuthTokenPrefix
$hexTime = dechex(time()); // Time in Hexadecimal
$output = $modx->resource->_output;
// We 'll find the folder with the regexp
$filename = preg_match('#assets/files/[a-z0-9\-._~%!$\'()/]*#m', $output, $matches);
$filename ="/" . basename($matches[0]);
$modx->log(modX::LOG_LEVEL_ERROR,$filename);
// Build the token
$token = md5($secret . $filename. $hexTime);
$modx->log(modX::LOG_LEVEL_ERROR,'Token : '.$token);
// Build the secured URL
$url = $protectedPath . $token. "/" . $hexTime . $filename;
$modx->log(modX::LOG_LEVEL_ERROR,'URL : '.$url);
$output = preg_replace('#assets/files/[a-z0-9\-._~%!$\'()/]*#m', $url, $output);
$modx->resource->_output = $output;
} then tick the OnWebPagePreRender in the event tab
In a page, make a link to your modx.zip file from the assets/files directory. Then try to reach your link from the frontend your link should be secured (15 minutes).
Please do not use this code on your production server, only on your test server
