What is the best place to store downloadable PDF invoices?

Question

My component will produce invoices in PDF format that will be available for customers to download.

Where is the best place to store these files?

/adminitrator/componentes/com_mycomponent/invoices

/componentes/com_mycomponent/invoices

/media/com_mycomponent/invoices

How can I prevent unauthorised users just directly downloading these files?

How can I prevent customers from downloading other people's invoices?

Answer 1

I would advise against using

administrator/components/com_mycomponent/invoices 

This is because it could pose a problem when you use .htaccess on your administrator directory. For example, with Akeeba Admin Tools

I would prefer using the media folder as well.

You can also serve the hashed files with their proper original names like this:

<?php
header("Content-type:application/pdf"); 

// It will be called NICE_TITLE.pdf
header("Content-Disposition:attachment;filename='NICE_TITLE.pdf'");

// The PDF source is in HASHED_FILE.pdf
readfile("HASHED_FILE.pdf");
?>

Answer 2

This may not answer your question directly, but I wanted to give another point of view on this question.

I would try to avoid as much as possible storing documents that you can generate. Reason: you need to decide on folder names / file name, which later are hard to change. It may use too much space and could pose security issues.

Of course this depends on how your application works, but ideally I would have the invoice data in database tables and generate invoices on the fly, when needed.

My two cents.

Answer 3

Just thought I'd throw in my 2 cents (some good points in hashing the filename).

I recently had a similar issue. Instead of worrying about .htaccess, I just save the files above public_html, with a component parameter specifying the path, then using PHP's readfile to fetch and output the PDF.

Won't work with all hosts, but for most applications it's relatively low-effort and completely prevents any hotlinking or other access.

Answer 4

Never store any user generated files in the component directories. You may end up loosing them during an update of your component (if not done properly) or for sure when the user uninstalls it.

The correct place to store such files is actually the "images" folder. It's the place where the user will be able to manage the files easily using the media manager. The "media" folder would be another viable choice, but it is actually more meant to hold extension assets like CSS, JS and the like.

However if the files contain sensible data which should not be available to anyone, then storing them in any of this folders is a bad idea. Even if you hash them you can be sure that someone eventually will be able to read them.

If it needs to be secure, either don't store the file at all and generate it instead dynamically on request. Or store it outside of webroot and access it using PHP. There is no other secure way.

Answer 5

Using the following directory as a root for all invoices is perfectly fine:

administrator/components/com_mycomponent/invoices

However, what I would recommend doing is hashing the file name once the invoice is generated. Like so:

administrator/components/com_mycomponent/invoices/HASHED_FILE.pdf

Either that or, for each invoice, create a hashed directory and store the PDF in there, like so:

administrator/components/com_mycomponent/invoices/HASHED_DIR/file.pdf

Update:

If this method is chosen, you can use a htaccess file to prevent direct access and only allow PHP driven access to these PDF files.

For a PHP driven download, I would suggest storing the hash in a database tabling, along with the user's ID. When a request is made to download the file, you can then match the ID you've stored with the ID of the logged current logged in user, and of course, match the hash stored in the database.

Answer 6

To me its media folder best fit for that purpose. To restrict direct access, just create .htaccess file in your folder with the below content.

DENY FROM ALL