Downloads Module: Download Gallery v1.0 Final released

[cnwb]

Updated the following

Cleaned and added to the following files:
info.php-updated information
install.php- add new data tables
help.php- added information fixed spelling
modify_file.php- added new tab's started the image insert process
modify_group.php- added hook to languages file in download gallery. started the image insert process
modify_settings.php- added image control feature(borrowed from VideoPlayer module)

Thing's that still need work on:

Database hook for image files frontend and client side.

modify_file.php-configure thumbnail to show in modify/edit after file is saved so you can see the image you uploaded.
modify_group.php--configure thumbnail to show in modify/add group after file is saved so you can see the image you uploaded.
save_file.php- hook to new database fields and or table
save_group.php- need to hook images to database
view.php- add hook to database to show thumbnail

A complete look over of this demo version of download_gallery for any ideas 

Implement this from doc..

@johnp
Maybe we can integrate the PEAR HTTP Download class to allow for "true hidden" downloads.
This would allow to hide the download URL from the users. Can share the code with you if you like.

Regards Christian

This is still a demo version and should not be mistaken
for a replacement of the current 1.9 version thats in the add-ons
area that is a good working version

[doc]

Hello John,

pleasee find attached a standalone demo for the usage of the PEAR HTTP Download package.
Simply copy the files to a directory in the webroot of your test server and give it try.

The package reads a file with a prefix (salt_xxx.zip) in the folder /downloads and sends it to the browser as xxx.zip. Idea is to create a unique id during file upload which is stored in the database and added to the physical filename itself. This makes it possible to identify the true file path via a unique file id and offer whatever file name you want.

The download directory is protected via .htaccess to prevent direct downloads in the unlikely case the true file name is guessed. However, a index.php should be added to the download folder to prevent directory listing at any case (redirect to view script).

Another improvement would be to make use of the template system shipping with WebsiteBaker (/includes/phplib). This allows to seperate PHP code and HTML statements and to keep readability and maintaining of code more easy. If you need some help on that, please let me know.

Regards Christian

[cnwb]

New Version 08-27-2008

Added the following input fields
WB Fourm User
Contact Email
Development State
WB Thread
WB Link
Also See
description - (WYSIWYG Editor) updated
special instructions - (WYSIWYG Editor) new
Previous Release Information - (WYSIWYG Editor) New

[cnwb]

OK! After spending many hours beating my head against the wall I came up with a simple solution.


I needed a way to upload an image to show a sample snap shoot of what ever the download files is
but I also wanted a way to insert images from media folder also so I just created another WYSIWYG box
and by doing this is gives more more flexibility to add to that section.

Although I sure their is a better and much cleaner way of doing this.
If some one else could figure a better solution just use one of the downloads above

thanks

JP

[freckles]

Hi

I've been asked to add 'client areas' which are private - this part is easy to set using the User/groups.

They also want to have private downloads on these pages. I've protected the 'download_gallery' folder with .htaccess and all works fine if I'm logged in as a admin, but logging in as a client (rights to all pages and only their own preferences) seems to prevent the download working.

Is there a way to mark a file as only downloadable by a certain User/Group?

kind regards
Freckles

Hello John,

pleasee find attached a standalone demo for the usage of the PEAR HTTP Download package.
Simply copy the files to a directory in the webroot of your test server and give it try.

The package reads a file with a prefix (salt_xxx.zip) in the folder /downloads and sends it to the browser as xxx.zip. Idea is to create a unique id during file upload which is stored in the database and added to the physical filename itself. This makes it possible to identify the true file path via a unique file id and offer whatever file name you want.

The download directory is protected via .htaccess to prevent direct downloads in the unlikely case the true file name is guessed. However, a index.php should be added to the download folder to prevent directory listing at any case (redirect to view script).

Another improvement would be to make use of the template system shipping with WebsiteBaker (/includes/phplib). This allows to seperate PHP code and HTML statements and to keep readability and maintaining of code more easy. If you need some help on that, please let me know.

Regards Christian

[ffenton]

I know I must be missing something really obvious here but I can't find the answer in this thread or the module help file.

On my site I have a private area restricted via log in to a group called Customers. In this area I have a page using Download Gallery v1.9. Customers can see the list of pdfs that are available for download but are unable to download any of them. If I log in as administrator I am able to download them. So how do you amend the permissions so that the group Customers can download the files?

[freckles]

Hi ffenton

Yep, same problem. The only way I could find to get around this was to :
- .htaccess protect the folder that the downloads were to come from (to prevent direct URL access)
- then don't use the module but make a list with normal links in a WYSIWYG panel

This means that the client is then required to log in to see their page of downloads (links to the file), when they click, they need to enter another username & password (could be set the same) to get past the .htaccess protection.

Without  the .htaccess its not secure, with it - I wonder if the download_gallery would be able to work anyway??

--

Also had a similar problem with the 'newsletter' snippet. Here, the client was unable to edit/delete email addresses until I changed the user account so that they had access to the settings panel and a few others -- which I would rather not have done. Don't know why it worked, but must have something to do with how the permissions are functioning.

Hope this helps.

regards
freckles

[michap]

Hallo,

I would like to add a time code to every event. is it possible to include this feature into the great event calendar?!

regards
Micha

[JasonB]

This is still a demo version and should not be mistaken for a replacement of the current 1.9 version thats in the add-ons area that is a good working version

I see you've been making some nice improvements to this module. Any idea when you plan to release it? I'm really looking forward to the thumbnail image enhancement.

[FrankH]

I know I must be missing something really obvious here but I can't find the answer in this thread or the module help file.

On my site I have a private area restricted via log in to a group called Customers. In this area I have a page using Download Gallery v1.9. Customers can see the list of pdfs that are available for download but are unable to download any of them. If I log in as administrator I am able to download them. So how do you amend the permissions so that the group Customers can download the files?

This has been corrected in the current version 2.05 of Download Gallery 2
http://www.websitebakers.com/pages/modules/listings/various/download-gallery-2.php

[Gerard]

I use Firefox most of the time. When I download a .jpg file out of my downloadgallery, it is shown in the browser. Nice, but not neccesary; I just want to download it. When I rightclick on the shown image and click "Save as", the browser shows the name: "dl.php" instead of the name of the file. Is there a solution for both things?

[zarathustra.at]

I know I must be missing something really obvious here but I can't find the answer in this thread or the module help file.

On my site I have a private area restricted via log in to a group called Customers. In this area I have a page using Download Gallery v1.9. Customers can see the list of pdfs that are available for download but are unable to download any of them. If I log in as administrator I am able to download them. So how do you amend the permissions so that the group Customers can download the files?

This has been corrected in the current version 2.05 of Download Gallery 2
http://www.websitebakers.com/pages/modules/listings/various/download-gallery-2.php

Because of this I think it would make sense to take out DG v.1.91 of the official add-on repository and replace it with DG 2.xx, as it's a major flaw of the 1.9x version.

[Argos]

I use the latest Download Gallery (currently 2.21) on a page for registered users. But the downloads are stilll accessible when not logged in, and using the direct link, like http://www.domainnamehere.nl/media/download_gallery/filenamehere.pdf

This shouldn't be possible, should it?

[FrankH]

Solution: Just do not give the filename away and do not let users list directory contents on your server.
All WB users use the same user account of the web server, so you can't stop some users to download the file directly while you allow it others, because the web server does not know anything about WB user groups.

[Argos]

Solution: Just do not give the filename away and do not let users list directory contents on your server.
All WB users use the same user account of the web server, so you can't stop some users to download the file directly while you allow it others, because the web server does not know anything about WB user groups.

I understand that, but it would be nice if the real url's were hidden and only the module string was visible, like http://www.mydomain.com/modules/download_gallery/dlc.php?file=14&id=1289332787. Best would be a dynamically generated random string (I guess the current number in the url is a unix time stamp), that only leads to the download if you are logged in.

Standalone download scripts have this most of the times, so it can be done. But I don't know if it's doable for the WB module.

[FrankH]

I value the comfort of useful file names in downloads.
In my opinion, this is more worth than what you gain by hiding it from the end user.
Of course, you are always free to put your downloads into a directory whose name is not guessable.

[Argos]

I value the comfort of useful file names in downloads.
In my opinion, this is more worth than what you gain by hiding it from the end user.

Well, the filename could be left as it is, but could maybe be have a randowm prefix or suffic, or the path could have a random code.

Of course, you are always free to put your downloads into a directory whose name is not guessable.

The "problem" is not names that are guessable, but files that are accessible bypassing the account login. I don't want people to give the download urls to someone else. This is an intranet site that only should be accessed after login. Downloads that can be called bypassing the login is not something my client would appreciate.

[Argos]

Another wish of mine would be the grouping of files per group. Now it's just a long list of all files of all groups together. Why not group the files in the backend like in the frontend?