Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Possible Duplicate:
How to Protect Uploads, if User is not Logged In?

Is there any way at all to restrict direct access to files within a specific folder to only specific wordpress users that have that specific capability set?

share|improve this question

marked as duplicate by Rarst Nov 17 '12 at 19:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Limit access to specific PHP files in a directory? Or ALL files in a directory? –  MathSmath Jan 12 '11 at 4:26
    
Limiting access to all files within a specific directly from direct access to everyone EXCEPT those users who have that specific capability. –  NetConstructor.com Jan 14 '11 at 7:24

1 Answer 1

up vote 2 down vote accepted

The easiest php solution would be to make a download script. It checks if the user has the right permissions and serves the file to the webclient. Or my preference setup a folder outside your web root and put the files there.

Set the file permissions with no anonymous access and let the webserver read them and output them in a php file like this. The below code reads the file and sents it to the browser.

header("Expires: 0"); 
header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); 
header("Cache-Control: private",false); 
header('Content-disposition: attachment; filename='. $file;
header("Content-Transfer-Encoding:  binary"); 
header("Content-Length: ". filesize(ABSPATH.$dir.$file); 
readfile($dir.$file);
exit();

edit 14-1:

create a normal upload box and when the file gets uploaded move it to a folder outside of your webroot directory (this folder can not be accessed by users through http, only the webserver.

if (move_uploaded_file( $_FILES['Filedata']['tmp_name'] , $upload_dir.$filename ) ) {
// code to do after the file has been copied succesfully. Update your database or something.
}

$upload_dir.$filename is the full path to the directory outside the www folder. The file can now only be accessed by the webserver. Store the location in a database with uploader info. Or create subdirectories for each user. You need something to differentiate the files for each user.

Now when you want to download a file create a script called download.php In that script you check if the user has rights to the file.

global $user;
if ($user->id == $uploaded_user_id) {
    header("Expires: 0"); 
    header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); 
    header("Cache-Control: private",false); 
    header('Content-disposition: attachment; filename='. $file;
    header("Content-Transfer-Encoding:  binary"); 
    header("Content-Length: ". filesize(ABSPATH.$upload_dir.$file); 
    readfile($upload_dir.$file);
    exit();

}

now you want to pass a file_id or name to the download script. so craft the link like url/download.php?file=$file. You have to call this directly or at the early stages of your plugin or you will get the headers already sent message. The script will check if the user has rights and start to output binary data.

It should be something like this, hope it helps. Its not the complete but should get you started.

share|improve this answer
    
thank you very much for your response. I would greatly appreciate if you could expand upon your answer. See, what I would like to do is create a custom upload metabox which uploads files into a specific folder on the server. I would then like to restrict direct access to those files by the public to all website visitors except for those users who are logged in and have the specific capability of viewing all these files. What do you think would be the best way so this can take place? –  NetConstructor.com Jan 14 '11 at 7:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.