Textpattern Forum

You are not logged in. Register | Login | Help

#11 2010-10-25 22:40:56

net-carver
Admin
From: UK
Registered: 2006-03-08
Posts: 1,646

Re: Password protect file download

@Alan

you wrote:

Hi Stef, folks,

I can see a requirement for this coming my way and I was wondering if in the intervening time anything has happened with the neat solution of TXP accessing content that is not web/http available

  1. not relying on .htaccess
  2. guaranteeing that no URLs could get found that could allow uncontrolled access.

<snip>

Is this do-able now or might it be one day, via a chargeable plugin perhaps?

Yes, I have a for-pay set of library routines (not a plugin) that allow this. I developed these to allow instant digital downloads (amongst a range of other things) so there is an option to integrate with paypal IPN messages if needed — but the two parts are very easily decoupled if you only need protected file access.

Files are stored outside the web root and the library gives you a choice of what kind of access protection to provide. You can have files password protected (or not), with a limited number of downloads, or an expiry date, or a mixture of all of the preceding. There’s even a one-time-pad implementation should you require a different password for each individual download of a protected file.

Please get in contact via forum email if you’d like to discuss your requirements further.


Steve
Textile | My plugins on GitHub | @netcarver

Offline

#12 2010-10-26 12:29:21

alanfluff
Member
From: Ottawa, Canada
Registered: 2008-09-15
Posts: 220
Website

Re: Password protect file download

Thanks Steve :)

I just replied via forum email.

Cheers, -Alan


At LAST I’ve cheerfully donated to the core devs at #TXP. I only wish I were able to give more. Thanks to the devs and ALL fellow TXPers. -A

Offline

#13 2010-10-27 00:54:37

net-carver
Admin
From: UK
Registered: 2006-03-08
Posts: 1,646

Re: Password protect file download

The solution seems to be really quite simple — and it doesn’t have to involve any paid-for software and can be done in Txp with one, existing, plugin.

Here’s how you do it…

  1. Gocom was correct to suggest using a folder outside your site root. So, create your folder … let’s call it ‘myfiles’ outside your site root.
  2. Go to admin > prefs > advanced and change the absolute path Txp is going to use for your files in File directory path to point to the ‘myfiles’ directory you just created. Files can no longer be directly downloaded from mysite.tld\files so no .htaccess tricks needed. mysite.tld\file_download is now the only way to get the files and we are about to add a lock to that door…
  3. Grab, install and enable the ign_password_protect plugin. Switch it over to using its own tables and don’t let it authenticate against the Txp user table.
  4. Upload all your files through the Txp files tab as usual — but notice with ign_password_protect you can now assign each file a permission. In Leo’s case he’d want to assign public files the permission called None and just one of the non-zero ‘Levels’ to be his ‘Board Only’ permissions before he saves anything that is for their eyes only.
  5. All ‘eyes-only’ files should be added to a file category that you need to create called ‘Board-Only.’
  6. Create logins for all the board members1 and assign them privs to access the single ‘Board only’ permission you are using for their files.
  7. Create a section called ‘Board-Only’, give it a whole page template if you want or just add a corresponding if_section conditional into the default page template.
  8. Inside that section add the ign_password_protect tags that require board-members to login. See the plugin documentation for help with this.
  9. Within the login tags, create your list of file download links that are of file category ‘Board-Only’

Tada! Legit board members should now be able to login to their private section and see the links to all files of category ‘board-only’. ign_password_protect should allow them to download the files via the links. Other, non-board visitors, even if they guess a board-only link, should no longer be able to download the file.

Here endeth the theory. I’ve checked out most of this but not everything suggested here — I leave that as homework for interested parties.

1 Actually, Leo, I think you could probably get away with a single ‘Board’ login that all board members can share if you never need to make any further distinction between what different board members can download. This would simplify user management a little if there are a lot of folks on the board.


Steve
Textile | My plugins on GitHub | @netcarver

Offline

#14 2010-10-27 14:30:22

alanfluff
Member
From: Ottawa, Canada
Registered: 2008-09-15
Posts: 220
Website

Re: Password protect file download

Steve, you are a gentleman and a scholar!

THANK you :D

Cheers, -Alan


At LAST I’ve cheerfully donated to the core devs at #TXP. I only wish I were able to give more. Thanks to the devs and ALL fellow TXPers. -A

Offline

#15 2010-10-31 23:14:36

net-carver
Admin
From: UK
Registered: 2006-03-08
Posts: 1,646

Re: Password protect file download

Leo, Alan

Did this work out for either of you? Please let me know if anything breaks down for you or if all goes well.


Steve
Textile | My plugins on GitHub | @netcarver

Offline

#16 2010-11-01 13:58:30

alanfluff
Member
From: Ottawa, Canada
Registered: 2008-09-15
Posts: 220
Website

Re: Password protect file download

Hi Steve,

Sorry no f/b yet — the requirement is still in the offing, but not happened yet, but as soon as I have feedback I will certainly let you know.

Cheers, -Alan


At LAST I’ve cheerfully donated to the core devs at #TXP. I only wish I were able to give more. Thanks to the devs and ALL fellow TXPers. -A

Offline

#17 2012-08-12 09:22:22

phuture303
Member
Registered: 2008-09-14
Posts: 118

Re: Password protect file download

net-carver schrieb:

The solution seems to be really quite simple — and it doesn’t have to involve any paid-for software and can be done in Txp with one, existing, plugin.

Well, this is what I’ve been searching for – a client wants exactly THIS, and it works perfectly. Many thanks!

Offline

Board footer

Powered by FluxBB