I'm working on a site that has certain pages that are going to be restricted to members only. It's using an external membership database to authenticate members, not EE's native members. Some of the secure pages have a Wygwam field and users can add links to files within that field. I'm trying to figure out how to secure the links to files that are contained within the Wygwam field and looking for any help or guidance on best practice for this type of thing.
We're using LinkVault on other sections of the site where we have file upload fields and it works great, but I can't figure out how to do something similar with links that are contained in the wysiwyg.
Here's what I've got so far:
- Store all the secure files above the web root
- Use the upload directory URL stored in the EE upload directory settings to point to a location that is set up as an alias for the directory stored above the root
- Use htaccess to redirect the user to a php file that checks if they are logged in.
I'm not sure what to do past that or if I'm thinking about this the wrong way. Once I check that they are logged in do I use the same php page to serve up the file somehow? Can anyone think of an easier way in EE to point to those files, check to see if the user has logged in, and then serve up the file if they have?