2

can you help me with little problem.

I need to find a solution, how to redirect user to login page when he wants to download file over link in post content, so, I have some files and I want them to be available only for users that are logged in, otherwise they should be redirected on login page, for example I want to forbid access (download) for all files from wp-content folder, keep in mind that I have several of those folders in the root, I tried with .htaccess file file but its not working

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://(www\.)?brt\.keezst\.com/ [NC]
RewriteCond %{REQUEST_URI} !hotlink\.(gif|png|jpg|doc|xls|pdf|html|htm|xlsx|docx|mp4|mov) [NC]
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule .*\.(gif|png|jpg|doc|xls|pdf|html|htm|xlsx|docx|mp4|mov)$ http://brt.keezst.com/ [NC]
2
  • Very bad to rely on cookies for this. The user could simply set a cookie with the same name and any value, and they'd have access to the files. Nov 8 '17 at 13:12
  • True, its not good practice but it's not that important in this case, they just force user to make profile (not necessary), if i find another solution I will post it here.
    – Marko.dev
    Nov 8 '17 at 13:20
4

I wouldn't use htaccess for that.

What I would do is make a 'download page' template and use it to 'serve' the files.

By doing that, I can do a check with is_user_logged_in() Codex and redirect with wp_login_url() Codex

Just do:

if ( is_user_logged_in() ) :
//file link
else :
    wp_login_url();
endif;

I think it's easier and safer to do that. Besides, you can even make that into a plugin later and use it on another projects or keep using it if you change your site template.

6
  • Thanks for the answer, but, I already have around 30k links on website, it's website that is moved from Joomla cms to wordpress, I could do that but it would be time consuming. I need something like htaccess solutions so i can just place it there and all links from that folder wont be accessible if user is not logged in.
    – Marko.dev
    Nov 8 '17 at 10:44
  • Ok, got it. So, are your files located in the 'upload' folder? Nov 8 '17 at 10:54
  • Yes, and there are several more folders in root folder that I made that are containing files from old installation, website is huuge so I'ts hard to upload every file into media, it's easier just to move whole directory and change permalinks with MySQL querry.
    – Marko.dev
    Nov 8 '17 at 10:59
  • If you can move everything to the 'upload' directory its easier to prevent access for non-logged users. You can also check this post: link Nov 8 '17 at 11:04
  • The user will still be able to download the files if they can guess the URL in the wp-content path. Depending on your exact situation, this ranges from easy to very easy. Nov 8 '17 at 13:06
1

Thanks to Marcelo Henriques answer i figured out how to make this work with .htaccess file and here is the code:

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} ^.*(mp3|m4a|pdf|doc|xlsx|docx|xls)$
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule (.*) http://website.com/login/

place .htaccess file in folder you want to protect from non registered users and it will do the job, last line is redirect.

So, if you want to protect file access over anchor link, from specific folder (uploads/media) make .htaccess file inside folder and paste this code. If you want just 403(forbiden) change RewriteRule (.*) http://website.com/login/ with [R=403,L]

1
  • 1
    This doesn't actually check to see if the WP user is logged in (as per your question). This simply checks for the absence of wordpress_logged_in anywhere in the Cookie: header (which is easily faked). You can't authenticate the WP user in .htaccess alone.
    – MrWhite
    Nov 8 '17 at 12:07
1

I recently wanted the same, except I wanted to secure invoices only.

I put this above the WordPress part of the .htaccess

<ifmodule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*wp-content/uploads/invoices/.*
RewriteRule ^wp-content/uploads/(invoices/.*)$ read-file.php?file=$1 [QSA,L]
</ifmodule>

This redirect everyone that wants to go to a file in the invoices directory to read-file.php wich is located right in the toplevel of WordPress as well. read-file.php has the following code to check if the user is logged in

<?php
// Load wp
require_once('wp-load.php');

// If user is logged in
if( ! is_user_logged_in() ) {

    // Redirect to home
    wp_redirect( url to your login page );
    exit;
}

// Additional checks here
// Headers to open or download the file
// readfile( $file );
// exit;

Hope it helps!

5
  • Thanks, this could be solution too, but I found solution above, check that, it's more simple.
    – Marko.dev
    Nov 8 '17 at 11:25
  • Unlike the other solution, this actually prevents access to files in the wp-content directory (or relevant subdirectory). You could easily adapt this to block all access to the wp-content directory. Nov 8 '17 at 13:08
  • What's not given here is the code to deliver the file if the user is logged in. You're redirecting them to the login page if they aren't logged in but if they are logged in then they'll just be left with a blank page. Hint: look at PHP's readfile function and make sure to avoid exploits that will give someone access to files on your web server that are outside the wp-content directory. Nov 8 '17 at 13:10
  • @MichealJohnson that's right. I should not forget that part. Though in my case its only to open PDF files wich i created the headers for. But i'll still add it to prevent confusion.
    – Wilco
    Nov 8 '17 at 14:03
  • @Wilco That's not good. Someone could write http://example.com/wp-content/uploads/../../wp-config.php and get your Wordpress config file (including database username and password), and depending on your web server configuration they could also write http://example.com/wp-content/uploads/../../../../../../../etc/passwd and get your server's passwords (and a bunch of other things). Nov 9 '17 at 8:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.