Download Gallery security issue: anyone can download

[lausianne]

Hi,

I just noticed that anyone can download files in my download gallery media directory. I have a few files that are only meant for registered users. Only these users can open the Download Gallery page on my website and download files there. Fine.

But: whoever knows or guesses a download link (e.g. http://www.asdf.org/modules/download_gallery/dlc.php?file=123), can download the file. Since the files have numbers, you don't even need to guess the filename. Simply try numbers from 1 upwards ...

Is there any way to restrict access to these files?

I'd appreciate your suggestions.

Cheers, Ralf.

[doc]

Hello,

the download gallery was never thought for secure file downloads. If your webhoster uses Apache as server and allows you to create own .htaccess files, the following workaround should help.

a) create a new folder for the secure files e.g. /media/secure/
b) protect the directory using Apache .htaccess (see WWW or Bookmark section on help website for details)
c) upload your secure files to this directory
d) select the files in this folder via DLG
e) try it

Regards Christian

P.S.: If you have some knowledge of PHP, you may want to use the PEAR HTTP_Downloads package to create your own download script for "secured" downloads.

[lausianne]

Hi Christian,

thanks for your reply. I cannot use htaccess directly, but I can protect folders through the web server interface which should do the same. I will try what you suggested and let you know how it went.

Could I not simply protect the download gallery folder itself?

I don't have enough knowledge to use the PEAR package, unfortunately ...

Cheers,
Ralf.

[doc]

Hello,

easiest way to protect a folder and files contained in it is usign htaccess.
Other possibility is to write a secure download gallery which "hides" the true file name. There are scripts available in the WWW which make use of the PEAR_Download package.

Christian

[lausianne]

Hi,

Thanks for the hint about PEAR. I found this on their site:
http://pear.php.net/package/HTTP_Download/

I think that would do it, if I knew how to use it. Not there yet.
Still waiting for my provider to let me protect my folders ...

Cheers,
Ralf.

080709: Ok, I protected the download gallery folder. Now, when you click on the download link, you have to enter username and password to actually download. Not ideal, but acceptable, and safe enough ...

[doc]

Hello,

German users, can have a look on the Pear OpenBook. Chapter 6 shows how to use the HTTP packages.

Christian