hiding a download url in modx with php

hope i found the right area of the forum to post this. I have a problem, client wants to suddenly sell digital content for download, of course had I known this I may have gone with a ecommerce cms solution. Their site is built on Revo, I have looked at paypal’s api, but I am not sure I am capable enough to do that since I am a lone designer who desperately needs to learn advanced php.
I have looked at solutions that host the file and tie into paypal, etc. as well as x developer where there is a good tutorial on how to use php with paypal’s api. But I realized that perhaps one easy way to do this is to use the simple paypal button and serve the link on redirect back to the client’s site . You see, it’s for one file, I made sure of that by being clear about scope.
So I figured that I could place the paypal buy now button on a resource which is assigned to a group, therefore an individual would have to login and isn’t accessible from directly from the browser, also I could make the resource that paypal returns to also assigned to a group, all good, but as you know, anyone can look at the source code of the paypal button to find out where the returnpage and therefore, the file is located.
I have found some php solutions on how to hide the true url of a download, but I am not sure how to implement the following in modx...has anyone else had to do this by any chance?

here is an example of the code I found

Having PayPal redirect to a page containing a snippet that used $modx->sendRedirect() to forward the user to the page with the download might work.

The snippet would have to contain some kind of check to make sure the user qualified either using the PayPal API or some other test, so other users wouldn’t be forwarded.

thanks bobray

so something like this then? where i confirm that a person is coming from paypal and redirects directly to the download file, and if not echo a message. I am sure this is crude,not even sure if it is right, I am just hoping my logic is pointing me in the right direction; but as i mentioned, I am very good with much other than css and js.


<?php
$_SERVER["HTTP_REFERER"]
if ($_SERVER=="http://paypal.com")
$modx->sendRedirect(’http://www.mydomain.com/assets/mydownloadfiles/file.zip’);
else
echo "You theiving scum,pay first!";
?>

Though not MODX-specific, the material here might help
[urlhttp://www.ngcoders.com/php/selling-digital-goods-with-paypal-ipn-and-php[/url]

Matt

I think you’re on the right track, but you can’t trust $_SERVER["HTTP_REFERER"]. It can be faked. I think you’d have to use PayPal’s IPN, though I’ve never done it.

There’s some info here that might help: http://net.tutsplus.com/tutorials/php/using-paypals-instant-payment-notification-with-php/.

You’d have to move the code into a MODX snippet.

Does Foxycart work on Revo? I think they have those types of permissions built in...

I’ve got round this in Revolution by protecting a folder by a cookie with .htacess and writing the cookie at the appropriate stage, like on order success or login.



It’s not 100% security but depending on the value of your digital goods it may be sufficient.

@sparkyhd, could explain a bit more what you are doing there with .htaccess, i am intrigued.
@bobray, I looked at the tutorial, it seems simple enough but what I am worried about is creating a database for download login, since the site is already using modx’s native login, I’d hate to confuse users.

The site already has an area where clients login to pay for services, which is easily done with a simple paypal button. Since the site doesn’t require a cart solution, I was hoping there was a way to do a down and dirty solution with a simple buy now paypal button and that service’s redirect back to site feature.

I mean, when you really get down to it, nothing is 100% secure, but if there is simply a way to avoid having the return page’s url as the only thing needed to gain access to the file, it would suffice for something like this.

i have looked and even installed vision cart and the vision cart paypal extension, but unfortunately, there is little documentation, none outlining the paypal extensions use, plus right off the bat, when I went to the visioncart extensions to configure them, there were TWO paypal modules listed. I asked about this in the visioncart forum, but there was no answer, that’s why I am asking about this here. visioncart has had quite a few downloads, and people seem to be happy about it, but some questions of mine, as I said above, really haven’t been answered...guess it’s best for those who can look at the source code and understand more or less each function.
just a designer. If the project was bigger, I would of course go with an ecommerce solution, or at least subcontract to php guru here at the forums.

You might want to consider this: www.vibralogix.com/linklokipn/ rather than try reinventing the wheel.

yeah cyclissmo, I saw that, and to tell you the truth, thought that’s exactly the way to go if all else fails. I am sorry for the hassle guys, there is php which a designer can use and tweak which has almost no site security implications, but once you get into DB,forms, payments and user management, it seems to me you really have to know what you’re doing.

I guess I was looking for an easy way to keep a casual trouble maker away from the file...of course a serious hacker will work your site until he/she gets in.