I need a way to have certain post attachments (images/pdfs/etc) be restricted to specific logged in users.
What is the best way to do this?
At a high level it seem like I need to do the following:
- Divert the attachment to a secured folder (eg. outside of the webroot).
- Write a controller of some sort to check if the user is allowed to access the file and then output the bits of the file if they are.
However, when I do that I can't figure out how to change the attachment URL that Wordpress generates so that I can do step 2. Wordpress assumes that it's still in the normal upload directory.
So, how do I change the URL when I'm changing the upload directory and is there a better way to go about this?