Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a restricted area on a website that can only be accessed by logged in users. For that I created a page template with a 'current_user_can()' condition.

My problem is that the documents attached to the restricted pages are still accessible to anyone if you put the complete path into the browsers address bar.

Is there a way to restrict the access to uploaded files ?

EDIT : I want to clarify, the files should be accessible only to logged in users.

share|improve this question

4 Answers 4

up vote 7 down vote accepted

This isn't really a WordPress question - but you can add a rewrite rule to prevent access unless the referrer is your own domain.

[Update]

You'll need to do 2 things

  1. Add a rewrite rule (either directly with .htaccess or by using WP_rewrite (Codex reference). The aim here is to deny requests to your documents that don't have your domain as a referrer - this stops people pasting the link into a browser's address bar

  2. Wrap your download links in an is_user_logged_in (Codex reference) conditional block - that way they will only show up on the page if the user is logged in

A code example is available in a related question:

share|improve this answer
    
Hi anu, the referrer has to be my domain + the visitor has to be a registered and connected user. I believe it is a WP matter. –  mike23 Apr 4 '11 at 12:16
1  
Seems like an htaccess question to me. –  curtismchale Apr 4 '11 at 14:49
    
I'll update my answer –  anu Apr 4 '11 at 16:41
    
Hi anu, yes that doesn't show the files if a user isn't logged in, but what if a user guesses the filename? He can still access it! And that's what I want to avoid. Let me give an example, let's say we have a corporate website with some public documents (report2011.pdf, report2010.pdf, etc.) and some private documents (report2009.pdf, report2008.pdf). Even if the private documents are not shown on the public website, somebody could guess some filenames easily (based on the structure of the public ones) and thus acces the private docs by just typing the URL into the adress bar. –  mike23 Apr 7 '11 at 14:35
4  
Two words: referer spoofing. Your solution is nothing more than 'security by obscurity': The attacker cannot access the media file if she/he knows the complete URL to it. Instead she/he has to know now one of the valid referer URLs. What have we gained instead of a higher administrative complexity? IMHO nothing. At the time of writing this, there are "thousands" of plugins for protecting pages and posts, but Wordpress still lacks a useful protection for media. The Wordpress (and plugin) developers avoid this, as they know what the consequences –  user14010 Mar 11 '12 at 10:09

I would change upload dir for one outside the www folder. Then you "send" the file using a "proxy" page. The proxy page check is the user is logged then it send the file using header()/readfile().

share|improve this answer

The registered user only plugin looks only to make sure that a visitor is logedin before viewing your page content. Access to your files via a browser is controled by the server.

You should try the WP plugin AskApache Password Protect - http://wordpress.org/extend/plugins/askapache-password-protect/

Of course this will only work if your WordPress blog is hosted on an Apache server.

share|improve this answer
1  
Not sure how to use this plugin. ANy ideas which options should I choose? –  user3047 Jun 8 '11 at 22:04

You may use hot-linking protection using your webserver of choice.

See this StackOverflow answer:
http://stackoverflow.com/questions/1775582/apache-hotlink-protection-for-download-folder.

This is using apache2 .htaccess

Basically, you are denying the download, if the user is non coming from a page of your blog!

share|improve this answer
    
I don't have experience with this stuff... any idea what should I put into my .htaccess file? –  user3047 Jun 8 '11 at 22:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.