PHP Security of a FOLDER / DIRECTORY ON IIS

I am hosting MODx on an IIS Server.

I store all my .PDF Files in a folder called /secure/somefoldername/filename.pdf

Is there a way that I can use MODx to prevent users from directly linking to the .PDF and redirect them to my secure signin page first.

I am using ISAPI Rewrite an for IIS and it redirects users to my secured_document.html when they click on a link.

I then built wrote code that checks if my user is logged in and redirects them to the .pdf after they login or gives them a link to click if they are already logged in.

But if I paste the link to that same .pdf in the browser, I can’t stop them from accessing the document.

ANY HELP WOULD BE GREATLY APPRECIATED.

I have tried HELICON HOTLINK BLOCKER, but when this ISAPI Filter is activated all my .PDF seem to hang when the user tries to access them.

Jason.

I used this on a website recently.

http://modxcms.com/extras/package/?package=147

We added each PDF as a page in MODx then linked to the MODx Page, which had the appropriate security groups applied i.e. members only.

Aaron

Thanks,

but not the solution my company is looking for.

The .PDF needs to be provided to members.

http://www.tsia.com/member_spending_report_ps_2010.html
I have done something similar here. When the user logs in, the document title becomes a link to the PDF or Powerpoint or what ever other DOCTYPE is associated with abstract.

My problem is that once the user knows the URL to the document, they can distribute to anyone that is not a member.

I really did look at your suggestion about 3 or 4 months ago.

Thanks.

The snippet I suggested can hide the true URL of the document so even if a member does give out the link, it will only be to the MODx protected page URL.

http://modx.scottydelicious.com/blog/2008/06/15/filedownloadpe

Have a look at this link:

Download Same file, different URI: Downloaded 1119 times.
http://modx.scottydelicious.com/downloads/random-name-whatever.zip

As an example, I duplicated this document (The new document’s ID is 37) and gave it an alias of random-name-whatever.zip. As you can see, the URI does not need to match the actual file name. It can be whatever you want. The actual file was uploaded to the root of my site, but you can put your files in any web accessible folder.

Let me know if you get stuck, we had exactly the same requirements as you do for a client and this works a treat for them.

Aaron