Secure file downloads from "logged in" members area

[eluser]jay2003[/eluser]
Hi,

I have a secure area on a system I am building and need to give access to logged in users to download files from a document store I have created. The area is secured using CI/code rather than HTTP on the server.

When it comes to linking to the file is there a way this can be stored in a folder that cant be accessed by URL when they aren't logged in?

Thanks in advance

Jason

[eluser]Stefan Hueg[/eluser]
The easiest way is to create an .htaccess file inside this directory, containing:

Code:

deny from all

And make a PHP function/class which is retrieving the file and sends it to the browser on logged in state.

[eluser]jay2003[/eluser]
Hi,

Thanks for that - any advice on how to create a function to retrieve the file and pass it to download?

Thanks

Jason

[eluser]Stefan Hueg[/eluser]

Code:

$full_path = './my_path/my_file.pdf';
    
    if (file_exists($full_path))
    {
     $this->load->helper('file');
     $file_mime = get_mime_by_extension($full_path);
    
     if (empty($file_mime))
     {
      $file_mime = 'application/octet-stream';
     }
    
        header('Content-Description: File Transfer');
        header('Content-Type: ' . $file_mime);
        header('Content-Disposition: inline; filename='.pathinfo($full_path, PATHINFO_BASENAME));
        header('Content-Transfer-Encoding: binary');
        header('Expires: 0');
        header('Cache-Control: must-revalidate');
        header('Pragma: public');
        header('Content-Length: ' . filesize($full_path));
        ob_clean();
        flush();
     echo read_file($full_path);    
    } else {
     show_error('File not found', 404);  
    }

[eluser]jay2003[/eluser]
Thanks will give that a go now and let you know how i got on.

Appreciate your help.

Jason

[eluser]jay2003[/eluser]
That worked a treat!

One thing - is there any way to get it to force download of jpg (and other images which the browser decides to show instead of prompting to open/save)

Thanks

Jason

[eluser]Stefan Hueg[/eluser]
Instead of

Code:

header('Content-Type: ' . $file_mime);
header('Content-Disposition: inline; filename='.pathinfo($full_path, PATHINFO_BASENAME));

use

Code:

header('Content-Type: application/force-download');
header('Content-Disposition: attachment; filename='.pathinfo($full_path, PATHINFO_BASENAME));

With this you can remove any MIME-related function as it is no longer required then.

[eluser]Stefan Hueg[/eluser]
Be aware of the fact that you may run into a memory-limit error on PHP-side because it will read the whole file into your RAM and send it to the browser afterwards.

It's pretty simple and basic and fine for smaller files, but if you need to send larger files than your memory_limit allows you'll have to dive into buffers and chunked downloads.

[eluser]jay2003[/eluser]
thanks for that - is that just for the latter to force download or is that just doing downloads in this manner?

Thanks

Jason

[eluser]zoopstud[/eluser]
This works for larger files