Securing documents

I have a page that is restricted to a specific web user group, then upload files from the resource browser to that page. People could easily get to that page without access if they type in the direct URL to the files. How can I restrict access ?

Glad to help but don't totally follow. Are you saying you have a protected page that allows users to upload files from that page? When you say people could easily get to "that page" what page are you referring to?

Which version of MODX are you using?

Quote from: BobRay at Apr 23, 2013, 01:03 AM

Which version of MODX are you using?

We are on ModX 0.9.6.1B installed on Windows Server

Quote from: dinocorn at Apr 22, 2013, 10:41 PM

Glad to help but don't totally follow. Are you saying you have a protected page that allows users to upload files from that page? When you say people could easily get to "that page" what page are you referring to?

We have a members only area on our site. The contents of that page can be viewed only after successful login. This page contain links to some files on the same server. Once the link is copied, these files can be accessed by anyone without supplying credentials. ModX is installed on Windows Server 2008.

In the first place, that is a very old and insecure version of MODx. You should upgrade to the latest version of MODx Evolution (1.0.10 at this time).

As far as the files go, there's nothing you can do about that if you're using ordinary links to access them. The only way you can secure them is to use a file downloading snippet that will stream the file on demand, and keeping the files themselves outside of the web root, or using a web server rewrite rule to deny access via URL. Since the PHP script is using file system access rather than web access, the web server's deny rules don't have any effect on it.

Quote from: sottwell at Apr 24, 2013, 02:47 AM

In the first place, that is a very old and insecure version of MODx. You should upgrade to the latest version of MODx Evolution (1.0.10 at this time).

As far as the files go, there's nothing you can do about that if you're using ordinary links to access them. The only way you can secure them is to use a file downloading snippet that will stream the file on demand, and keeping the files themselves outside of the web root, or using a web server rewrite rule to deny access via URL. Since the PHP script is using file system access rather than web access, the web server's deny rules don't have any effect on it.

Thanks Heaps.. Much appreciated.. Does the new MODx Evolution has an option to secure the files ?

I'm pretty sure there are several add-ons to take care of that. Here is one http://modx.com/extras/package/filedownloadplugin