9

I have a restricted area on a website that can only be accessed by logged in users. For that I created a page template with a 'current_user_can()' condition.

My problem is that the documents attached to the restricted pages are still accessible to anyone if you put the complete path into the browsers address bar.

Is there a way to restrict the access to uploaded files ?

EDIT : I want to clarify, the files should be accessible only to logged in users.

Improve this question
0

5 Answers 5

Reset to default
7

This isn't really a WordPress question - but you can add a rewrite rule to prevent access unless the referrer is your own domain.

[Update]

You'll need to do 2 things

  1. Add a rewrite rule (either directly with .htaccess or by using WP_rewrite (Codex reference). The aim here is to deny requests to your documents that don't have your domain as a referrer - this stops people pasting the link into a browser's address bar

  2. Wrap your download links in an is_user_logged_in (Codex reference) conditional block - that way they will only show up on the page if the user is logged in

A code example is available in a related question:

Improve this answer
8
  • 1
    Hi anu, the referrer has to be my domain + the visitor has to be a registered and connected user. I believe it is a WP matter.
    – mike23
    Apr 4, 2011 at 12:16
  • 1
    Seems like an htaccess question to me.
    – curtismchale
    Apr 4, 2011 at 14:49
  • I'll update my answer
    – anu
    Apr 4, 2011 at 16:41
  • Hi anu, yes that doesn't show the files if a user isn't logged in, but what if a user guesses the filename? He can still access it! And that's what I want to avoid. Let me give an example, let's say we have a corporate website with some public documents (report2011.pdf, report2010.pdf, etc.) and some private documents (report2009.pdf, report2008.pdf). Even if the private documents are not shown on the public website, somebody could guess some filenames easily (based on the structure of the public ones) and thus acces the private docs by just typing the URL into the adress bar.
    – mike23
    Apr 7, 2011 at 14:35
  • 6
    Two words: referer spoofing. Your solution is nothing more than 'security by obscurity': The attacker cannot access the media file if she/he knows the complete URL to it. Instead she/he has to know now one of the valid referer URLs. What have we gained instead of a higher administrative complexity? IMHO nothing. At the time of writing this, there are "thousands" of plugins for protecting pages and posts, but Wordpress still lacks a useful protection for media. The Wordpress (and plugin) developers avoid this, as they know what the consequences
    – user14010
    Mar 11, 2012 at 10:09
3

I would change upload dir for one outside the www folder. Then you "send" the file using a "proxy" page. The proxy page check is the user is logged then it send the file using header()/readfile().

Improve this answer
1
  • I know this is old, but can you build out a demo?
    – klewis
    Mar 28 at 15:16
1

You may use hot-linking protection using your webserver of choice.

See this StackOverflow answer:
https://stackoverflow.com/questions/1775582/apache-hotlink-protection-for-download-folder.

This is using apache2 .htaccess

Basically, you are denying the download, if the user is non coming from a page of your blog!

Improve this answer
1
  • I don't have experience with this stuff... any idea what should I put into my .htaccess file?
    – user3047
    Jun 8, 2011 at 22:05
1

This worked for me. You can prevent access to the wp-content/upload folder (excluding logged in users) by creating a .htaccess file and adding the following rewrite rule:

# Disable directory browsing
Options -Indexes

# Redirect non-logged-in users to the login page
RewriteEngine On
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule \.(pdf|jpg)$ /wp-login.php [L,R=302]
Improve this answer
0

The registered user only plugin looks only to make sure that a visitor is logedin before viewing your page content. Access to your files via a browser is controled by the server.

You should try the WP plugin AskApache Password Protect - http://wordpress.org/extend/plugins/askapache-password-protect/

Of course this will only work if your WordPress blog is hosted on an Apache server.

Improve this answer
1
  • 1
    Not sure how to use this plugin. ANy ideas which options should I choose?
    – user3047
    Jun 8, 2011 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.