Protecting folders with downloadable files?

I've set up a secure area on our client's website where they have a few pages with links to downloadable files - mainly PDFs, all containing sensitive corporate information. I used SecurityAssist to set up the secure pages and have also set up PowerCMS on the pages so that they can upload the documents and update the pages themselves. The upload folder sits within the /secure directory. However, I have now discovered that if someone has a direct link to the PDF (i.e. www.mywebsite.com/secure/document.pdf), the file is not protected and can be downloaded by anyone. This is no good as the files are the things that they specifically want to protect.

I did see another post about this and I now know that SecurityAssist can only protect PHP pages - you suggested uploading PDFs to the root directory and then creating a download behaviour, but I don't think this will work for me as a) the root folder is write protected and b) since they are uploading the files themselves and creating links on the pages, how can they create a download behaviour themselves with only enough basic knowledge to operate a simple CMS?

My temporary workaround is to put a .htaccess file in the /uploads folder and then create the same usernames and passwords to access it, but this means that users have to login twice which isn't very practical. How can I achieve what I need to do?

outside of using htaccess to secure the directory and loging in twice, the only option is to store the files outside the site root and use security assist download.

you wont be able to do this with CMS.

create a table to hold the file names

create insert/update admin pages using data Bridge bridge to upload the files to the directory outside of the site root, and save the file name to a database.

create a page for download, add a recordset to lookup the file names in the table. add a form with a submit button and a hidden elemeent in it.

bind the hidden element to the file name column from the recordset.

add a repeat region around the form

in the download file behavior, bind the file name setting to the hidden field.

Hi Jason, I managed to find a better workaround and thought I would post in case it helps anyone else. I used .htaccess but instead of password protecting the folder, I set it up to prevent direct linking to any downloadable files - the only way to access them is through the page in the secure folder.

Options +FollowSymlinks
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mywebsite.com/secure(/)?.*$ [NC]
RewriteRule .*\.(flv|mp4|pdf|xls|doc|mov|wmv|avi|ppt)$ http://www.mywebsite.com/images/DENIED.png [R,NC]

interesting, thanks for posting that.

You may also try to force download with PHP:

<?
$file="/path/to/file" //file location
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($file).'"');
header('Content-Length: ' . filesize($file));
readfile($file);
?>

http://99webtools.com/php-force-file-download.php

my root is one up from html, but it is still inside www..... /var/www/html/opentopublic

do I need to go up two directories or being inside www is still ok? this is confusing.

You need to go up enough so that the file can't be browsed to directly from the web. The exact directory depends on how your web server is set up. The concept is that you put it in a directory that can't be accessed directly so you can provide download links that only work to verified users.

This post has been deleted.