Restricting acces to download

[marxav]

I was wondering if there is any way to limit files guests could download as opposed to registered users?

[cyberman]

I'm not a coder for real, but I think there's no solution.

Sure you can write an ip or session or cookie based filesize counter. But then the guest have only to change session and ip and delete cookie so he can download what he want ...

The only way to limit guest is to give him only access for few files, and members have access to complete file base.

[KO]

You could try this. This is one way to restrict access only to certain files that Cyberman mentioned.

You have 2 different folders in you server with different htaccess files. One that has no rules (or no htaccess file) and another has rules that accepts only links from your domain. And those links are visible after user has logged in with FrontEnd users. To set up your htaccess file you could look for "htaccess prevent hotlinking". Here is one link to tutorial. http://www.devpapers.com/article/242

Hope this helps,

K

[marxav]

That would be an approach for a short term solution, but HTTP_REFERER can be spoofed so I am somewhat reluctant. 

[calguy1000]

There's no absolute solution, yes HTTP_REFERER can be spoofed.  So a good additional solution would be to obfuscate the links so that people don't know the absolute location of the file.

That's what the uploads module is good for.  As well, it provides download tracking.

[KO]

There is also "Tag" to obfuscate links to files that was added quite recently but I have no experience from that. See http://dev.cmsmadesimple.org/projects/securefile/

[marxav]

I will have to give this tag a try.  My problem is not with upload (or there is something I don't understand about this module) as I have direct access to the server.  I just want to limit who can download what.  And of course tracking downloads is certainly a nice to have.

Thanks.

[calguy1000]

The Uploads module was originally written to allow others to upload files to my site, and then to allow sharing of the files.  Though I can still upload files via ftp to share with the Uploads module.

It provides for a description, a summary, an icon, a thumbnail for each image file.  thumbnail generation for images, and link obfuscation, As well, as I said earlier allows for download tracking.

In combination with the FrontEndUsers module and the Customcontent module, I can configure it so that only certain peopole have access to certain categories/directories of files. 

The Uploads module is currently in use in themes.cmsmadesimple.org and numerous other sites.

I think it'll do what you need to do, and in combination with the .htaccess stuff will provide a reasonable amount of security.

[marxav]

Calguy, I think this all rocks.  It took me a couple of hours to figure everything out, but it was worth.  So for others' benefit, I think we can summarize as follow:

In order to use CMSMS as a "library" you need the following modules:

• CustomContent
• FrontEndUser
• Uploads

CustomContent will allow you to control who see what, FrontEndUser to assign users/groups to the library, and Uploads to manage the content of the library itself, including the display (Templates).

There is almost enough meat here for a HowTo.