Description
HAQ Member Document Drive gives your site a private document area. Administrators create folders and decide, member by member and folder by folder, who may view, download, upload or create sub folders. Members sign in, see only the folders they were granted, and work with their own files.
Files are stored outside the reach of the browser and are served through a permission check on every request, so a shared link is useless to anyone without rights to the folder.
For administrators
- Create, rename and delete folders and sub folders.
- Upload files on behalf of members, rename them and remove them in bulk.
- Approve, reject or block each registration before the account can be used.
- Grant download, upload and create folder rights per member and per folder.
- Review and action account deletion requests.
- Browse a full activity log of uploads, downloads, renames and deletions, filter it and export it to CSV.
- Configure organisation name, notification addresses, upload limits, allowed file types and more from a single settings screen.
For members
- Browse only the folders they have been granted.
- Download single files or select several and download them as one archive.
- Upload files by drag and drop, with a progress bar and clear error messages.
- Create sub folders where an administrator has granted that right.
- Edit their profile, change their password and request that their account be closed.
Privacy
The plugin stores the account status, profile details and per folder rights of each member, plus a log of the file actions they perform. Nothing is sent to any third party service by default.
If you optionally enable Cloudflare Turnstile on the sign in and registration forms, those forms load a script from Cloudflare and each submission is verified with Cloudflare’s siteverify API. This is an opt-in Software as a Service integration. See Cloudflare’s privacy policy and terms of use.
Installation
- Upload the
haq-member-document-drivefolder to/wp-content/plugins/, or install the plugin through the Plugins screen in WordPress. - Activate the plugin. The database tables, the protected storage directory and the four member pages are created for you.
- Go to HAQ Member Document Drive > Settings and set your organisation name and notification email addresses.
- Go to HAQ Member Document Drive > Folders and create your first folder.
- Go to HAQ Member Document Drive > Members to approve accounts, then use Access rights to grant folder permissions.
The four pages created on activation are My Drive, Sign In, Register and Reset Password. You can move the shortcodes to pages of your own and select them under Settings > Pages.
FAQ
-
Where are uploaded files kept?
-
In
wp-content/uploads/haq-member-document-driveby default. The plugin writes an.htaccessfile, aweb.configfile and anindex.phpfile into that directory so the files cannot be fetched directly. Every download goes through a WordPress request that checks the member’s rights and a one-time nonce first. -
What if my server ignores .htaccess?
-
Move the storage directory somewhere outside your web root by defining
HAQMEDOD_STORAGE_DIRinwp-config.phpwith an absolute path. The plugin will use it and the files will be unreachable by URL regardless of server configuration. This is the recommended setup on nginx and similar hosts. -
Can I allow any file type?
-
You can choose which extensions members may upload under Settings > Uploads. Executable and script types such as
php,phtml,exe,sh,pharandsvgcan never be allowed; they are rejected even if you add them to the list. Uploads are also checked so that a renamed executable cannot pass on its extension alone. -
Which shortcodes are available?
-
[haqmedod_drive]— the member drive.[haqmedod_profile]— profile, password and account closure.[haqmedod_login]— sign in form.[haqmedod_register]— registration form.[haqmedod_lost_password]— password reset form.
Legacy aliases
[haq_drive],[haq_drive_profile],[haq_drive_login],[haq_drive_register]and[haq_drive_lost_password]still work. -
Do new members get access straight away?
-
No. A new registration is held as pending and cannot sign in until an administrator approves it. If you would rather not review each one, clear Hold new accounts until an administrator approves them under Settings > Membership.
-
I am upgrading from version 1.x. Will I lose anything?
-
No. On the first load after upgrading, the plugin moves existing uploads into the protected directory and converts the old per member access data to the new format. Your folders, files and logs are kept.
-
What happens to my data if I delete the plugin?
-
Nothing is removed unless you ask for it. Deactivating never deletes anything. If you want the tables, files, options and member data cleared, tick Delete all folders, files, logs and settings when the plugin is deleted in the settings before you delete the plugin.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“HAQ Member Document Drive” is open source software. The following people have contributed to this plugin.
Contributors
Translate “HAQ Member Document Drive” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.1.0
- Compliance: text domain is now
haq-member-document-drive(matches the plugin slug). - Compliance: unique
haqmedod/HAQMEDOD_prefixes for classes, options, hooks, meta, AJAX, cache group and capabilities. - Compliance: late escaping with
esc_*/wp_kseson echoed output (Plugin Check EscapeOutput). - Shortcodes: preferred tags are
[haqmedod_drive],[haqmedod_login],[haqmedod_register],[haqmedod_lost_password]and[haqmedod_profile](legacyhaq_drive*aliases kept). - Upgrade: automatic migration from former
udrv_*/user_drive*options, meta, tables and capabilities.
2.0.3
- Distinctive plugin name: HAQ Member Document Drive. Text domain matches the plugin slug (
haq-member-document-drive). - Security: public registration always creates Subscriber accounts; the member-role setting was removed.
- Security: removed the Custom CSS setting so the plugin no longer stores or outputs arbitrary CSS.
- Contributors list now uses the WordPress.org username.
2.0.2
- Compatibility: passed WordPress.org Plugin Check blockers for review-ready packaging.
- Fixed: translators comment placement for Cloudflare policy links in settings.
- Fixed: Cloudflare Turnstile loads via
wp_enqueue_script()when the optional captcha is enabled (required Cloudflare API host). - Security: tightened sanitization of AJAX/profile input and clarified nonce-verified upload handling.
- Database: direct queries now use
$wpdb->prefix(oresc_sql()) in line with Plugin Check guidance. - Removed: manual
load_plugin_textdomain()call (WordPress.org loads translations automatically). - Removed: discouraged
set_time_limit()usage during downloads.
2.0.1
- Security: storage protection rules are rewritten when settings are saved, and removed when protection is turned off.
- Security: download links now require a nonce in addition to folder rights.
- Security: SVG and SVGZ uploads are refused by default as forbidden types.
- Security: registration no longer reveals whether an email address is already registered.
- Fixed: Settings can be saved by users who hold the drive management capability.
- Fixed: members with the create folders right can create sub folders and inherit access on them.
- Accessibility / i18n: admin prompts are localised; Cloudflare Terms of Use linked in settings and readme.
- Packaging: removed placeholder Plugin URI / Author URI; added directory index.php files; updated Tested up to.
2.0.0
- Rewritten as a standard WordPress plugin with an autoloader, a settings screen and admin pages for every feature.
- Added: database tables are created and upgraded automatically on activation.
- Added: settings for organisation name, notification addresses, membership rules, upload limits, allowed file types, logging, Cloudflare Turnstile and page assignments.
- Added: activity log filtering and CSV export.
- Added: full translation support and a
haq-member-document-drive.pottemplate. - Added: opt in data removal on uninstall.
- Added: automatic migration of files and access data from 1.x.
- Changed: uploads are stored in a protected directory and served through a permission check instead of being publicly reachable.
- Changed: the front end is rendered by shortcodes rather than page templates, so it works with any theme.
- Changed: assets are local and dependency free; the bundled jQuery copy, Bootstrap and CDN requests are gone.
- Security: every AJAX endpoint now verifies a nonce and checks capabilities and folder rights.
- Security: all database queries are prepared and all output is escaped.
- Security: allowed file types are an allowlist, executable types are refused outright and file contents are checked against the extension.
- Security: download archives are built in the system temp directory instead of the web root.
1.0.0
- Initial release.