4

Does anyone know of a straightforward way of securing files which have been uploaded via Solspace FreeForm?

In a nutshell, what I'd like to have is files uploaded to a directory which isn't accessible to the general public, but is accessible once you have logged into the CP as an admin user.

Edit: To clarify, Freeform just uses a standard EE File Upload destination and has a link within it's admin screens to view the uploaded file. I've tried creating a Destination which is above root, but that makes the file inaccessible from within the CP as well (unless I'm doing it wrong that is).

Edit 2: I seems if you try to access the file via the file manager in the CP it works fine if you have the upload destination above root. What isn't working is the link within Freeform itself. It uses the 'URL of Upload Directory' to link directly to the file. This results in a 404 if the destination is above the root.

Improve this question

2 Answers 2

Reset to default
6

Have you thought about making upload folder locations above root?

Here is an article about doing just that for Freeform file uploads: Storing file uploads above webroot in EE2

Improve this answer
2
  • I have. I've tried creating an File Upload destination which is above root, with an 'URL of Upload Directory' which is both an accessible url and also one which wouldn't be accessible e.g. '../somewhere/' and in both instances I get a 404 when trying to view the file from the Freeform admin screens in the CP. It satisfies the making it not viewable to public, part of the problem. It's the viewable to logged in folk that doesn't work.
    – Steve Holland
    Commented Dec 3, 2012 at 14:15
  • On further investigation. It seems it is working if you access the file through the File Manager. What isn't working is the link in Freeform itself. I guess this is because it just uses the 'URL of Upload Directory' to link directly to the file. The File Manager must do it differently. I guess I might have to live with this. Thanks for your suggestion.
    – Steve Holland
    Commented Dec 3, 2012 at 14:31
4

What sort of files do you need to lock down and how much security is required?
Below is a few methods i have used in the past.

Run it through PHP
I used a solution a while back when i used htaccess-rules to run every request for a particular dir through a special template and used Php and template-tags to verify that the user was logged in and had the correct permissions.

For added security you could do as @Cem said and store the files above root or just stick with locking them down with htaccess.

Found a quick example of the php code here.

If everything was ok i sent the correct headers and returned the file through php.
One downside of this could be the speedbump when you need to start up php for every single file.
Might work better for simple files than with multiple images on a page.

Cookies in htaccess
You could also use htaccess to verify that a cookie has been set and contains the correct value, the cookie could be set from EE.

Hashing the filename
Another way to go about it would be to add a unique hash to the filename and store that in the db. That way it would be impossible (see hard) for someone to guess the url to your files.

Improve this answer
3
  • Thanks for your suggestions. I was hoping there was a simple config type change to do in the CP rather than going down the coding an addon route. I've updated the original question with my findings.
    – Steve Holland
    Commented Dec 3, 2012 at 14:35
  • There are many ways to do it, if you check the link in my text the solution can be quite simple. htaccess and a bit of php in a template an voila.. you have yourself a bunch of secure files. All depends on what you want to use it for. ;)
    – Kim Wickell
    Commented Dec 3, 2012 at 14:58
  • Moving the upload folder above root as @cem suggested does in fact solve the issue. It's the link within Freeform which is at fault (in this instance). Nothing I can really do to change that sadly. Thanks again for your suggestions though, I think they may come in handy in the future :)
    – Steve Holland
    Commented Dec 3, 2012 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.