0

I have a WordPress site installed in the root folder. Beneath the root is a /docs folder with a bunch of older html files. I'd like to allow only logged in WordPress users to be able to have access to those /docs html pages (not to be confused with WordPress 'pages').

I created a WordPress 'portal' page which displays links to the /docs pages if the visitor is logged in. I would also like to put in a textual search function (which I know how to do) so logged in visitors can get a list of relevant /docs html pages

What I don't know how to do is prevent not logged in visitors from direct access to the /docs pages for both links and searches?

I know I could do these if I converted the html pages to php and checked a referer. But I don't want to have to redo all the old html if possible (if I have to do that I'll just import them into a WordPress taxonomy -- but I hope to avoid that!)

I looked at .htaccess and I was hoping to perhaps set an ENV variable or use REFERER, but I keep reading that such things are not reliable.

Ideas?

Improve this question

1 Answer 1

Reset to default
1

Take a look at this thread here - it covers using .htaccess to protect a directory based on a WordPress logged in cookie.

The .htaccess in case the thread goes missing - obviously you'll need to change uploads/premium to your directory:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} ^.*uploads/premium/.*
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule . /index.php [R,L]
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Edit: toscho has rightly pointed out this method is unreliable, as cookies are browser-based and easily spoofed. So, I'd like to add one more method: HEREDOC syntax. Quick and dirty, and probably horribly thought out, definitely a better way somewhere, but overall worth a shot. Basically, you'll do a global find/replace then a global rename on the html files in your /docs directory. Assuming your files all begin with <!DOCTYPE, simply find <!DOCTYPE and replace with this:

<?php include_once('/wp-config.php');
if ( is_user_logged_in() )
{ print <<<HTML
<!DOCTYPE

Then find your closing </html> tag and replace it with this:

</html>
HTML;
} else {
echo 'Who are you and how did you get this number?';
?>

Batch change the filenames to .php using Renamer or something similar, and viola - you've added WordPress functionality to your static html files. Of course, make sure you have a backup of your files before doing any bulk operations, no matter how certain you are they'll work. All it takes is one little typo and you've set yourself up for hours of tedious work reverting it.

Improve this answer
4
  • 1
    Everybody can send such a cookie. ;)
    – fuxia ♦
    Commented Jun 18, 2012 at 23:41
  • Of course they can, hence it not being reliable. But, it's better than nothing, and can work as a stopgap in the meantime. With the requirement of 'test against user logged in', the only other options are 'try out plugins for role management and hope for the best' or 'global find/replace to wrap the HTML in heredoc syntax and rename all to .php'. Neither of those are as quick-and-dirty as this, though - although the heredoc (while ugly) is probably the next quickest.
    – SickHippie
    Commented Jun 18, 2012 at 23:56
  • Hi, O/P here. The problem is that all the static html pages have lots and lots of <a hrefs> to various pages within the folder. So if I rename to php, then I have to go through every file and redo the links. I have tried doing regex changes before and something -always- goes wrong. Any suggestions on how to handle the links? --JC
    – jchwebdev
    Commented Jun 19, 2012 at 4:20
  • Sure - do a global find/replace for .html" to .php". The closing quote means it should only be replacing them inside the <a href="something.html">, without messing up any other tags. No need to write a regex, just Notepad++'s "find in files" function. Again, back up your folder to a safe place before starting, just in case.
    – SickHippie
    Commented Jun 19, 2012 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.