We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 12379
    • 460 Posts
    I’d like to have some pages visible only to users who have clicked on an email link (or link from another page in the web site/external site) which I’m guessing will require simple url authentication. They’re only low security pages - don’t want to go down the path of passwords or users.

    The link might look something like this:

    http://www.mydomain.com.au/offers/special-report-XXXXX

    ...where XXXXX might be the code within the url allowing the link to view the page (set using a TV on that page?)

    If somebody guesses the url "http://www.mydomain.com.au/offers/special-report" then they’re taken to a no entry page.

    oh yeah, limited programming experience over here!
      Mostly harmless.
      • 10449
      • 956 Posts
      hmm... in other words: not even a login needed (webuser group / role / doc group)? Also, not even a URL hash per user-email-address (check email string against an md5 or sha1 hash)? That’s low security alright smiley

      why not just create two pages?
      alias 1 = "special-report" -> "sorry, you’re not allowed..."
      alias 2 = "special-report-xxxxxx" -> "jump-to-conclusions mat VC page" -> show in menu = no (to avoid accidental sitemap or AjaxSearch listing)

      A slightly better solution would be to add a custom query string (GET variable), and check this against an email string, e.g.

      <?php
      
      // test with: [email protected]&h=93b15e6d0d39b8c10684cfd83bd969d3c0c57ee1
      
      $salt = "G309aAlqkWka_fyMao9aa7";
      $peppa = "Bvna99:r0o";
      $e = trim(strtolower($_GET["e"])); // email string
      $h = $_GET["h"]; // hash submitted via query string - has to match var $pie
      $cake = "$salt$e$peppa";
      $pie = sha1($cake);
      
      if($h != $pie) {
      	exit("NOWAI"); // or $modx->sendRedirect() or echo $modx->getChunk("noAccess")
      } else {
      	$chunk = $modx->getChunk("productSpecs");
      	echo $chunk;
      }
      ?>
      
        • 3749
        • 24,544 Posts
        Quote from: hotdiggity at Apr 30, 2009, 12:39 AM

        I’d like to have some pages visible only to users who have clicked on an email link (or link from another page in the web site/external site) which I’m guessing will require simple url authentication. They’re only low security pages - don’t want to go down the path of passwords or users.

        The link might look something like this:

        http://www.mydomain.com.au/offers/special-report-XXXXX

        ...where XXXXX might be the code within the url allowing the link to view the page (set using a TV on that page?)

        If somebody guesses the url "http://www.mydomain.com.au/offers/special-report" then they’re taken to a no entry page.

        oh yeah, limited programming experience over here!

        How about just not showing those pages in any menus and hiding them in robots.txt?
          Did I help you? Buy me a beer
          Get my Book: MODX:The Official Guide
          MODX info for everyone: http://bobsguides.com/modx.html
          My MODX Extras
          Bob's Guides is now hosted at A2 MODX Hosting
          • 12379
          • 460 Posts
          Thank you both. I’m open to suggestions, however I’ve been directed to make it as easy to access for the email recipient as possible so no passwords. This page will appear only briefly and then be deleted.

          I like the URL hash per user-email-address method. Our mailing list database is on a separate server - just not sure how I generate a individual hash for each user within the email itself...
            Mostly harmless.
            • 3749
            • 24,544 Posts
            If they’re truly low security pages (no SSNs or bank routing numbers) with a short lifespan, just hiding them from the Wayfinder menus and putting them in a directory marked noindex, nofollow in robots.txt would be by far the easiest.
              Did I help you? Buy me a beer
              Get my Book: MODX:The Official Guide
              MODX info for everyone: http://bobsguides.com/modx.html
              My MODX Extras
              Bob's Guides is now hosted at A2 MODX Hosting
              • 12379
              • 460 Posts
              OK I’ve done that as well. The pages have free downloadable report links in them so I’d prefer users not to share the links. I’ve just realised the links to these pages/files will be on the return page from a PayPal transaction. There’s something in Step 3 in Paypal about creating variable for a order confirmation page:

              3. Advanced variables (power users)
              Power users can add extra PayPal button variables here. Use a line break between the variables you enter below. These variables will be included in your button HTML code.

              <b>Example</>
              address_override=1
              notify_url=https://www.mywebsite.com/PayPal_IPN
              [email protected]

              Not sure if I can use anything here?

              I’ve also been looking at fileDownloadPE snippet for screen the actual location of the files http://modxcms.com/extras.html?view=package/view&package=147
                Mostly harmless.
                • 10449
                • 956 Posts
                Well, in that case, just use notify_url=http://www.mywebsite.com/PayPal_MODx_page
                Maybe add a referrer-check for https://paypal then, via snippet.
                btw, PP has a developer sandbox. If PP sends you confirmation variables via POST to that URL, use these to do some addtl. checking (referrer alone is not 100% safe).
                  • 12379
                  • 460 Posts
                  OK thanks, that’s given me some clues. I’ve cobbled together the following snippet which seems to do the trick:

                  <?php
                  $referer = $_SERVER['HTTP_REFERER'];
                  $referer_parse = parse_url($referer);
                  
                  if($referer_parse['host'] == "www.paypal.com.au" && $referer_parse['scheme'] == "https" || $referer_parse['host'] == "paypal.com.au" && $referer_parse['scheme'] == "https" ) {
                       // download...
                       $chunk = $modx->getChunk("downloadURL");
                       echo $chunk;
                  } else {
                       //header("Location: http://www.mysite.com"); 
                       //$modx->sendRedirect();
                       echo $modx->getChunk("noAccess"); 
                       //exit();
                  }
                  ?>


                  Suggestions welcome. Might make it into a more usable snippet and post...
                    Mostly harmless.
                    • 12379
                    • 460 Posts
                    Hmm, while the above script works it doesn’t when receiving a post payment redirect from Paypal. There must be more to it. Any ideas?
                      Mostly harmless.
                      • 10449
                      • 956 Posts