File Manager Path Outside Root Directory

Yes, you are correct. The web user is able to upload files only (working fine). The manager users are the only ones that are allowed to download these files (not working).

The issue I am facing is that the link for downloading from the File Manager is a standard http browser anchor reference and therefore it is trying to download the file as a standard browser request.

I may be doing this wrong of course, but the .htaccess is stopping me from downloading these files from within the Manager as it would for a standard browser request outside of the Manager. The Manager download link just seems to point directly to the file like this: http://mysite/myuploads/myfile.pdf using the standard anchor reference like this: <a href="http://mysite/myuploads/myfile.pdf" style="cursor:pointer; width:20px;">image</a>

Hope that all makes sense

Yes, it makes sense. Sorry, I wasn’t aware about all the details how the file manager is implemented. It can delete the .htaccess file and thus make all protection useless, but it seems as long it’s there, you can’t get around it. So I stand corrected and see that .htaccess cannot solve your problem, as long as you want to use the file manager. Right now, I don’t have another idea for you ...

No problem, thanks for your input anyway nightsignals.

You have made me look at the problem in a different way and I may still be able to get it working using a similar technique to that which you suggested.

The download seems to be the only part of the file manager that does not implement script to carry out its function. This was why I thought that it may be a possible update for future versions of modx... if I manage to stumble my way through this then I will post my solution back here.

Cheers

You could write a quick module in the manager to give the manager users access to those files by using a php script to list the files, as well as to grab the content of the files from this location outside the web server paths and deliver it to the browser from the executing module script.

But I really do not think the file manager, at least not in any currently recognizable form, is the proper place for this specialized functionality of pointing at files any place on the file system.

Thanks OpenGeek, I am sure you are right. I am building a specialist system so this is may not be a good idea for all modx users.

I am not knowledgeable enough on these matters to be able to debate the issue, but I still do not see that if the download link was scripted instead of anchor referenced how anything would change other than the added ability of being able to download a file from outside the website root directory. The File Manager currently allows the uploading and deleting functions to work in this way and deleting would pose a greater risk than downloading wouldn’t it?

Anyway, my temporary solution was to make a folder inside the website root directory called uploads and password protected it with an .htaccess file as nightsignals originally suggested. Then inside the "uploads" folder I created another folder called "documents" and made this the root folder for the File Manager. This meant that the "documents" folder was password protected but the .htaccess file was not able to be accidentally deleted because it was one level higher than File Manager root directory.

This still meant that I was unable to download the files from within the File Manager so I just inserted the username:password I used to protect the folder into the anchor reference after the https:// and voilà... it works. Not exactly an elegant solution, but a solution none the less. The one issue is of course is that the username:password shows in the link and is therefore visible to anyone that has access to the File Manager. This is not a concern for my system but it may be for others.

I will revisit this and try to get my original idea working at a later stage when time allows... thanks to all that offered their advice.