close ad
 
Important WebAssist Announcement
open ad
View Menu

Technical Support Forums

Free, outstanding support from WebAssist and your colleagues

rating

Protecting folders with downloadable files?

Thread begun 1/16/2014 10:56 am by Mags | Last modified 12/20/2018 12:59 pm by Ray Borduin | 3306 views | 7 replies |

Mags

Protecting folders with downloadable files?

I've set up a secure area on our client's website where they have a few pages with links to downloadable files - mainly PDFs, all containing sensitive corporate information. I used SecurityAssist to set up the secure pages and have also set up PowerCMS on the pages so that they can upload the documents and update the pages themselves. The upload folder sits within the /secure directory. However, I have now discovered that if someone has a direct link to the PDF (i.e. www.mywebsite.com/secure/document.pdf), the file is not protected and can be downloaded by anyone. This is no good as the files are the things that they specifically want to protect.

I did see another post about this and I now know that SecurityAssist can only protect PHP pages - you suggested uploading PDFs to the root directory and then creating a download behaviour, but I don't think this will work for me as a) the root folder is write protected and b) since they are uploading the files themselves and creating links on the pages, how can they create a download behaviour themselves with only enough basic knowledge to operate a simple CMS?

My temporary workaround is to put a .htaccess file in the /uploads folder and then create the same usernames and passwords to access it, but this means that users have to login twice which isn't very practical. How can I achieve what I need to do?

Sign in to reply to this post

Jason ByrnesWebAssist

outside of using htaccess to secure the directory and loging in twice, the only option is to store the files outside the site root and use security assist download.

you wont be able to do this with CMS.

create a table to hold the file names

create insert/update admin pages using data Bridge bridge to upload the files to the directory outside of the site root, and save the file name to a database.

create a page for download, add a recordset to lookup the file names in the table. add a form with a submit button and a hidden elemeent in it.

bind the hidden element to the file name column from the recordset.

add a repeat region around the form

in the download file behavior, bind the file name setting to the hidden field.

Sign in to reply to this post

Mags

Hi Jason, I managed to find a better workaround and thought I would post in case it helps anyone else. I used .htaccess but instead of password protecting the folder, I set it up to prevent direct linking to any downloadable files - the only way to access them is through the page in the secure folder.

Options +FollowSymlinks
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mywebsite.com/secure(/)?.*$ [NC]
RewriteRule .*\.(flv|mp4|pdf|xls|doc|mov|wmv|avi|ppt)$ http://www.mywebsite.com/images/DENIED.png [R,NC]

Sign in to reply to this post

Jason ByrnesWebAssist

interesting, thanks for posting that.

Sign in to reply to this post

madahmani

You may also try to force download with PHP:

<?
$file="/path/to/file" //file location
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($file).'"');
header('Content-Length: ' . filesize($file));
readfile($file);
?>

http://99webtools.com/php-force-file-download.php

Sign in to reply to this post

anonymous

my root is one up from html, but it is still inside www..... /var/www/html/opentopublic

do I need to go up two directories or being inside www is still ok? this is confusing.

Sign in to reply to this post

Ray BorduinWebAssist

You need to go up enough so that the file can't be browsed to directly from the web. The exact directory depends on how your web server is set up. The concept is that you put it in a directory that can't be accessed directly so you can provide download links that only work to verified users.

Sign in to reply to this post
Did this help? Tips are appreciated...

anonymous

This post has been deleted.

Build websites with a little help from your friends

Your friends over here at WebAssist! These Dreamweaver extensions will assist you in building unlimited, custom websites.

Build websites from already-built web applications

These out-of-the-box solutions provide you proven, tested applications that can be up and running now.  Build a store, a gallery, or a web-based email solution.

Want your website pre-built and hosted?

Close Windowclose

Rate your experience or provide feedback on this page

Account or customer service questions?
Please user our contact form.

Need technical support?
Please visit support to ask a question

Content

rating

Layout

rating

Ease of use

rating

security code refresh image

We do not respond to comments submitted from this page directly, but we do read and analyze any feedback and will use it to help make your experience better in the future.

Close Windowclose

We were unable to retrieve the attached file

Close Windowclose

Attach and remove files

add attachmentAdd attachment
Close Windowclose

Enter the URL you would like to link to in your post

Close Windowclose

This is how you use right click RTF editing

Enable right click RTF editing option allows you to add html markup into your tutorial such as images, bulleted lists, files and more...

-- click to close --

Uploading file...