I have a question that I thought the below thread would provide the answer to, but things in WP have changed so it doesn't quite do it, although it helped my understanding of things.

How to protect uploads in multisite if user is not logged in?

Basically, I would like to not serve files that are attached to private posts unless the user is actually logged in. That apparently requires that all request go through a php file that basically does what the ms-files code die before it was removed from WP multisite in 3.5 (as I found out). The first approach in this answer

How to Protect Uploads, if User is not Logged In?

apprently still works for single site installations but as the rewrite code and the file structure for multisite have changed, the modifications in the first thread I linked to no longer work.

Frank Bueltge's approach (the second answer in the thread) even incorporates a check for the attachment's parent (and would thus allow a check for post_status) but somehow I can't get it to work. And somehow, the modified code he includes in his plugin "authenticator" also don't seem to work.


I understand that serving files through php is bad for performance, but as far as I understand, this is the only way a login-check/status-check can be logically done. Sadly, I can't seem to get any of the solutations to work for a multisite installation, given the changes since the removal of ms-files.php.

I'd really appreciate any help! Thanks a lot!

  • The class inside the Authenticator plugin is a starter point, not ready to use. I have include this as open issues. The problem is the enhancement of the .htaccess, not easy for a plugin.
    – bueltge
    Commented Oct 14, 2014 at 8:53
  • I wonder how a multisite rewrite rule would have to look to either use a modified ms-files.php with the new file structue or how it would have to look to use your class. I have to say that I don't entirely understand how the class is called through the http request and gets the $file to perform the checks. How would I hook the class in?
    – yms
    Commented Oct 14, 2014 at 12:54
  • The problem on the class is, that is was fired on init-Hook, to late for downloads outside the load of WP. You need a rule in the htaccess, that fired the class.
    – bueltge
    Commented Oct 14, 2014 at 15:54
  • Right, and that's why a rewrite rule is needed in .htaccess that directs all file requests to a php file, à la ms-files.php. But what would that rule look like for a multisite installation after WP 3.5 when ms-files was removed for new installs and the rewrite rules look different?
    – yms
    Commented Oct 14, 2014 at 19:46
  • Is the currently only way to protect files in multisite setups to install an older version and then update to ms-files is preserved and can still be modified?
    – yms
    Commented Oct 22, 2014 at 14:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.