Security: Protect files embedded into posts that require a login

  • SVTX

    (@12ax7)


    10 years, 7 months ago

    Hi all,

    I’m currently buildind a site that has sensitive information behind a login page. I’m using these plugins to achieve that:

    http://codecanyon.net/item/pages-by-user-role-for-wordpress/136020
    https://wordpress.org/plugins/theme-my-login/

    The first one is a premium plugin which requires a user being logged in as a certain user group in order to view the site. Now here’s the problem:

    I need to put PDF and Office files on to that page so the clients can download them but what no one seemed to think of is that the actual files are accessible to the public. Search engines that do not respect the Disallow: /folder setting would crawl and index the files.

    So… Is there a way to make sure a user is logged in when he downloads files of a certain type from the server? A little insight would be fantastic. I’ve read somewhere that a proxy script might be a good way to do it but I don’t know if I can dig so deep, my coding abilities are limited.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Thread Starter SVTX

    (@12ax7)

    10 years, 7 months ago

    Still no luck. There must be a way?

    Thread Starter SVTX

    (@12ax7)

    10 years, 7 months ago

    This is somehow not working because my files are served from a subdomain which points to the site root.

    RewriteCond %{REQUEST_FILENAME} ^.*(pdf|doc|docx)$
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule https://www.domain.com [L]

    Does someone know the wildcard equivalent to this code?

    Will I have to set a cookie domain (www.) in wp-config and specifically check for the cookie on that domain?

    I know this way of doing it is not 100% secure but it restricts them from the public eye, that’s enough.

    Ravikumar Patel

    (@ravipatel)

    10 years, 7 months ago

    Please Review this Answer

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Security: Protect files embedded into posts that require a login’ is closed to new replies.