I want that a logged-in user can upload a file. Then he should be able to download that file whenever he wants to. I have finished the uploading by using wp_upload_bits - so the files will be saved into the "uploads" folder.


So now I look for a secure and kind of 'best practice' way to accomplish the following: I want that only the user can download the file who has it uploaded. (Downloader has to be the Uploader of the same file). So there are 3 conditions to consider:

1) No direct access to the file (from outside)

2) User has to be logged-in.

3) Only when the user has uploaded the file he should be able to download that file

What I have done so far:

1) Upload works. File get uploaded to the uploads directory.

2) In the database I have a table where I store the path of the file and the user_id of the uploader.

  • 2
    the wp-upload directory is accessible with direct access then it's better to put files in a directory protected by the HTTP server. Then you can access the file with PHP and test is the current user can access this file.
    – mmm
    Oct 17 '17 at 8:49
  • This answer to a similar question may be of help: wordpress.stackexchange.com/a/37743/27757. Only you would also check if the user that is logged in is the same one that uploaded the file, by checking for the path in the database.
    – J.D.
    Oct 17 '17 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.