Front-end URL for Assets file download that is above root, should this work?

Question

I have a file upload directory above root in a folder called "secure_files". I can successfully upload files to this directory from within my Assets field. The file upload directory is setup like below...

Server Path to Upload Directory: /Users/mlohrman/Sites/secure_files/

URL of Upload Directory: ../

here's my template code..."file_upload_matrix" is my matrix field. "files" is the column with the Assets field in it. This successfully displays the files on the front end.

    {file_upload_matrix}
    {filename}
    {files}
    <a href="{url}">{title}</a>
    {/files}
    {/file_upload_matrix}       

The URL on the front-end is "../file.pdf". So when I'm on this page "http://site.com/departments/marketing/files/" it's trying to find the file at "http://site.com/departments/file.pdf".

Now I've done something similar using DevDemon Channel Files and had the same file upload settings and that plugin has a built in obfuscated links feature. I'm not sure what's happening behind the scenes, but setting the file URL to obfuscated would allow a person on the front-end to download that file that was sitting in the folder above root. I know Assets doesn't have the obfuscated link feature, but I thought I could try Link Vault plugin to do that for me. But I'm not positive the URL is correct now to pass to Link Vault. Any thoughts?

Answer 1

You can definitely use Link Vault to serve files that are above web root. There are a few different ways to construct a download link with Link Vault. Link Vault expects the path supplied to be relative to the web root so any one of these would work :

{exp:link_vault:download_link directory='../../files/' file_name='file.zip' }
{exp:link_vault:download_link file_path='../../files/file.zip' }

If the file does happen to be below web root, you can even use :

{exp:link_vault:download_link file_path='http://example.com/images/cat.jpg' }

The link that is generated gets encrypted so your files are safe and hackers can't just modify the parameters to go searching through your files (abbreviated example) :

http://example.com?ACT=50&file=eomDdQoswRC%2FqjxKLXR2Te0hebW7dtx%2B

We're always available in the support forum if you need help.

Answer 2

This could work with Link Vault or any of the link-obsfucation plugins (CartThrob has one built-in, for example). Just pass the plugin the {server_path} Assets variable.