Hello. I've been asked to design and develop a website which will have downloadable files (pdf, wav and mp3).

 

The URL (links) for these files need to be "hidden" so that only authorised people can download them.

 

Is there any way of supplying users of the site with a "once-only" encrypted URL link to the file that they want to download?

 

This could either be:

 

1. a password that ONLY works for their email address,

2. a URL that expires after a short time,

3. a script that moves the selected files into a temp directory with a random name, and deletes them after a short time.

4. an exe that downloads them without showing the user the links.

 

I'm stumped. Does anyone know how to do any of the above?

 

Are there any scripts (any language) out there already written that do something similar?

 

Can anyone think of a better solution?

 

Thanks.

1. a password that ONLY works for their email address,

2. a URL that expires after a short time,

3. a script that moves the selected files into a temp directory with a random name, and deletes them after a short time.

4. an exe that downloads them without showing the user the links.

 

1. Yup.

2. Yes. Look into cron jobs.

3. That's possible too, but I'd rather go with one of the approaches above.

4. Not a good idea.

 

The simplest way to do this would be to set up a table in your database for download tickets and pass them out via e-mail. You've worked with relational databases (MySQL etc.) before, right?

Hi,

 

You need to use a database (MySQL) and some moderately fancy PHP.

 

Effectively you will have a directory structure with permissions like so:

 

- /download_files ( .htpassword and .htaccess protected )

- adownloadfile.avi

- anotherfile.avi

- index.html (says "no direct access allowed" or a redirect to the homepage)

- .htaccess ( contains a .* rewrite so all files accessed are pointed to the index.html )

- download.php

 

And a mysql table like this;

id int(10) auto_increment primary key,
email varchar(128),
password varchar(40),
expires int(12),
file varchar(128)

 

email contains their raw email address,

password contains a sha1 hashed password (always 40 chars long),

expires contains a unix timestamp (one from 12:35:21 today is 1208259321) which is a date possibly in the future.

file contains the name of the file that this email/password is allowed to download.

 

for multiple files, use multiple rows, otherwise use a proper username/password system.

 

The download.php file would be accessed to them by a link somtehing like this;

 

download.php?email=php_penguin@hotmail.com

or if you want slightly less secure

download.php?email=php_penguin@hotmail.com&pass=2fd4e1c67a2d28fced849ee1bb76e7391b93eb12

 

The download.php then checks the provided email address and password against the database, and makes sure the expiry time is still in the future, and then allows the user to download the file (effectively by sending a download header and streaming the contents of the file through download.php)

 

If you are having trouble doing this yourself, I am for hire

Hi,

 

You need to use a database (MySQL) and some moderately fancy PHP.

 

Effectively you will have a directory structure with permissions like so:

 

- /download_files ( .htpassword and .htaccess protected )

- adownloadfile.avi

- anotherfile.avi

- index.html (says "no direct access allowed" or a redirect to the homepage)

- .htaccess ( contains a .* rewrite so all files accessed are pointed to the index.html )

- download.php

 

And a mysql table like this;

id int(10) auto_increment primary key,
email varchar(128),
password varchar(40),
expires int(12),
file varchar(128)

 

email contains their raw email address,

password contains a sha1 hashed password (always 40 chars long),

expires contains a unix timestamp (one from 12:35:21 today is 1208259321) which is a date possibly in the future.

file contains the name of the file that this email/password is allowed to download.

 

for multiple files, use multiple rows, otherwise use a proper username/password system.

 

The download.php file would be accessed to them by a link somtehing like this;

 

download.php?email=php_penguin@hotmail.com

or if you want slightly less secure

download.php?email=php_penguin@hotmail.com&pass=2fd4e1c67a2d28fced849ee1bb76e7391b93eb12

 

The download.php then checks the provided email address and password against the database, and makes sure the expiry time is still in the future, and then allows the user to download the file (effectively by sending a download header and streaming the contents of the file through download.php)

 

If you are having trouble doing this yourself, I am for hire

thats a really cool solution...

Thanks php_penguin. That sounds excellent.

 

I've only just quoted for this site at the moment, so will let you know if I get it.

Is it possible for you to create a simple upload script that on upload it will automatically change the name of the file? With such script you can also set variables that will check if the file has been inactive for a while and if it has, it will automatically remove it from the server. I've noticed couple of file hosting sites using this idea. Here's something I would try to use, not sure if it will work as i think it would for deleting old files. (This will require database)

 

foreach( $file_raw as $key => $value ) :

		$time = time() - $value;

		if( $time >= $options['unix_timetodeletion'] ) :

			$file_delete[] = array('fileid'  => $key,
									'email'   => '',
									'siteurl' => '');

		endif;

	endforeach;

			// Get userdata for deletion notice
			for($i = 0; $i < sizeof($file_delete); $i++) :

				$str = 'admin_email';				
				$sql = mysql_query("SELECT option_value FROM ht_" . $file_delete[$i]['filed'] . "_options WHERE option_name = '$str'");

					while ( $row = mysql_fetch_assoc($sql) ) :

						$file_delete[$i]['email'] = $row['option_value'];

					endwhile;

				$str = 'siteurl';
				$sql = mysql_query("SELECT option_value FROM ht_" . $file_mail[$i]['fileid'] . "_options WHERE option_name = '$str'");

					while ( $row = mysql_fetch_assoc($sql) ) :

						$blogs_delete[$i]['siteurl'] = $row['option_value'];

					endwhile;

			endfor;

The code was based on something I saw on a different site but was used for deleting old and outdated posts.

Unfortunately simply renaming the file does not fulfill the purpose here - if one person was given the link they could then pass it on to as many people as they wanted, whereas with the method I proposed, there is both a time limit and an easy option for a download limit. (eg 5 downloads within 3 days)