Protecting physical documents from download in admin area

I have a Revolution 2.2.0 site where I'm setting up an "admins only" area where the client can manage details of their own clients. I use a redirect so that if the user is a member of Admins they get sent to a particular resource ID when they log in. Their welcome page and all their various other pages that they use for administering their area are all placed in a Resource group that only Admins can access.

So all "their" pages are protected from other user groups and the general public.

Now the problem is that they need to be able to upload and download actual physical documents (e.g .txt, .doc, .pdf etc.) related to the data that they manage. For example I have a form that uploads a document, adds its name into the database and simultaneously copies it to a folder (let's say /docs/clients) on the filesystem. I then want to have a link to that file outputted to the form they use to edit those details, so they can click on it and it opens in whatever application. In theory that's fine- my problem however is that there's nothing to stop anyone browsing to (for example) mysite.com/docs/clients/myfile.pdf and accessing it.

Unless I add a .htaccess to the document root (docs). But when I do that, the administrator can't access the document- he clicks on it and it goes to a 404.

So, how do I stop non-authenticated people from browsing to these files, while still allowing Admins the ability to access them? I'm guessing .htaccessisn't the answer because MODX doesn't seem to want to cooperate with it... but there must be some way? Anyone know?

You can make a media source pointing to a folder above the document root. Assign it to your group so only your admin users can access it. You will probably need to change the system setting for limiting file upload size; possibly you'll also need to change that value in your php.ini file and even your web server configuration as well.

Ok, found it. Will give it a go... thanks...

Hmm, unfortunately that doesn't seem to work. I created a new media source called docs, set it to point to a folder called docs inside assets (although I also tried it with a docs folder in the root), set Access Permissions so only Admins could access it, set the path to docs/ for both path and URL... but I can go to another computer and browse through that whole directory structure without being logged in, download files in there etc.

Also whenever I try to set the access permissions, it keeps coming up with an Access Denied message- even though I'm logged into the manager as the default administrator...

I tried flushing the permissions and logging back in, and the media source I created has disappeared! But when i try to create another with the same name, it says it already exists. And this is all while logged into the manager as the default admin...

I then tried flush sessions, and now I can at least see the most recently created media source- however even though I've set the access permissions so that only Admins should be able to access this folder (which I set as /assets/documents/ ) anyone can still browse to that folder via the web and view the files it contains.

Any ideas? [ed. note: galahad5 last edited this post 13 years, 3 months ago.]

Anyone know how I can stop people (anyone apart from the Admins group) just browsing to this folder structure? The Access permissions for the media source seem to be completely ignored and anyone can just browse the folders. ?

Surely it must be possible to prevent public browsing of this folder? Anyone know why the Access Permissions of the media resource are being ignored by the system?

I don't know if it's what you are looking for..
anyway if you put an empty "index.html" file inside your folder "docs", people should not see anything (if they don't know the exact path of your files!)

If you use Apache you can also disable directory listing, but the "index.html" way is more simple.

Thanks, that would stop the file listing showing, although the client will want to be storing sensitive documents in this area so if there's still a chance that someone could access the documents (I'm sure there's software that can crawl the contents of a folder providing them with links to the individual docs) then they won't be happy...

I'm just puzzled as to why setting the Access Permissions on the media resource doesn't do anything to stop public browsing...

I think that you can't avoid the access to a physical file with MODX, I mean if an external user browse to:

http://www.yoursite.com/assets/docs/hiddenfile.pdf

Modx isn't call in action so can't prevent access to this file.

I think you should try with some Apache restriction, for example disabling direct access to those files

Put the files in a folder above the web root. Use Static Resources to link to the files, then link to the Static Resource for making the file available. Create custom content types for the files; for example a .pdf type and a .docx type. You can even use a Media Source set to "../downloads/" (for example) for the path, or use an absolute file path, and ignore the URL fields.

Just keep in mind that Static Resources don't work properly with Media Sources; I use a chunk [[$linkPrefix]] with the ../downloads/ part. Static resources will see the Media Source, and the path it loads will be the path you see in the file browser, but it won't get the part that's in the media source's definition. So that part has to be prefixed to the path the static resource loads.