file access permissions only from chrono page

Restrict file access to only authorized users from a ChronoForms page.

Overview

Files stored in publicly accessible folders can be downloaded by anyone with the direct URL.
Move the files to a folder outside the web root and create a CF form to serve them. The form page can then enforce user permissions, allowing only logged-in users to trigger the file download.

teldrive teldrive 06 Oct, 2021
Hi everyone
a simple question but may be not easy to solve
i have lots of links to files into my chrono list of type http://myweb.com/2021/file.pdf
how can I restrict access to them in order only they can be accesed from web page(that of course has user restrictions)
Gr GreyHead 06 Oct, 2021
Hi teldrive,

I'm sure that this has been answered before but don't have time to hunt it down right now.

If I recall correctly the answer is to save the files in a folder above the domain root so that they are not directly available by URL, then create a form page that will download the file - or email it if you prefer. That form page can be limited to the appropriate restricted users.

Bob
teldrive teldrive 06 Oct, 2021
Answer
Thanks Bob, yes it works, just to share my code with everyone , in link to file
 https://myweb/trabajos/?option=com_chronoforms6&chronoform=descarga&file=file1.pdf
and in CF a form called "descarga", the key of this method is that /trabajos/ is a private folder so only registered user can acces to it and files are in the /doc/ folder , same place that /httpdocs/ folder, where only php program can access, I understand thtat this is the most secure method
if($this->data['file']){
$path_root=JPATH_SITE;
$parts = explode('/', $path_root);
array_pop($parts);
$this->data['path2'] = implode('/', $parts).'/docs/'.$this->data['file'];
}
Post a Reply