Protecting physical documents from download in admin area

Ok, well I created a static resource called "docs", and I've also created separately a physical folder called "docs" which is at the same level as public_html so therefore above the root of the site. I also set the SR to be a container (which I assume is correct- as it's a folder). Problem is, I don't know how to link the static resource and the physical folder, I can't see a way of doing this in the backend- when I clicked the Static Resource box it gives me a browse box to select the folder it points to, but it won't let me see anything other than the folders inside assets, i.e the default MODX filesystem, I can't see any folders above that and there isn't a way of browsing to them...

So I created a new media source called docs, pointing to ../docs/ and tried to point the static resource to that, but every time I save it and go back in, it's pointing back to the default filesystem again.???

I guess I need to somehow use a chunk, but where would I place the call for this- would it replace ../docs/ in the media source settings? And what code would the chunk itself actually contain? [ed. note: galahad5 last edited this post 13 years, 3 months ago.]

The static resource is linked to a physical file, not a physical folder.

That is why I have a chunk with the media source path "../docs/" in it. Use it in the path in the static resource (its content replacement field).


The static resource will pick up the path from inside of the structure exposed by the media source, it just won't pick up the media source definition path (the ../docs/ bit). Without that, it'll try to use the default web root path.

So presumably I would need to manually create a static resource for each physical file that I want to put in the folder? Unfortunately the client is going to want to put hundreds of files in this folder over time. If they are adding new files (via an upload script I make for them) then would that mean I have to then create a static resource for each and every file they want to add?

Yep. I'm currently working on getting thousands of files accessed with static resources. Partly for security, but primarily for the search capability. I'm experimenting with ways to automate or at least simplify the process.

Ah, ok. Would be great if we had a more integrated way of protecting documents from inside the system.

In the meantime, I've created a bit of a messy workaround (in case anyone else encounteres this problem or has similar file-protection requirements):

Set up a subdomain- docs.mydomain.com
Link it to the /docs folder but set it up so that the URL doesn't redirect to www.mydomain.com/docs/somefile...
Set an .htaccess on this subdomain only
Because it's a separate entity MODX doesn't complain about the .htaccess, and the folder is protected from public browsing
Inside the admins restricted area, they can click file links such as docs.mydomain.com/somefile and they get the password prompt box come up
With browser caching they only need to enter the username and pw once, so not too much trouble

It's an ugly workaround but it's all I can think of for the moment...