I'm looking for a way to provide a "secured" file download for authorized Joomla users (registered user being member of a certain group), but the "link" shall not be usable in any other way, such as copy&paste.

What do I mean by "secured"? It means the access to the file is securely restricted, not the actual file transfer, which is secured by enforcing HTTPS only access to the website.

I'm using something similar on a small non-Joomla web application as follows:

  • Files are store in a directory with file mode 700, and files have file mode 600, i.e. only a process running with owner id can physically access the data.
  • Apache is configured to run PHP scripts under the owner id of the script.
  • PHP scripts and above directory/files belong to the same user (UNIX user, not Joomla user)
  • Files are served with the help of some PHP lines as follows:
header("Content-Description: File Transfer");
header("Content-type: " . CONTENT_TYPE);
header("Content-Disposition: attachment; filename=" . USER_FILENAME);
header("Content-Length: " . filesize(SERVER_PATHNAME));
header("Pragma: public");
header("Expires: 0");
header("Cache-Control:  must-revalidate, pre-check=0");
header("Cache-Control:  private", false);
header("Connection: close");


I thought I might be able to use above code in a standard Joomla article with the help of Regular Labs Sourcerer extension. This allows PHP code to be run from within an article (or custom module).

Unfortunately, this does not work as expected, because Joomla (of course) has already set the HTTP headers before the PHP code will run. Only the readfile() function is honoured, and will force a download action in the browser. But the browser is receiving a text/html file with the page's HTML code instead of the desired file.

Now to my question: Is there any way to serve a file from a Joomla page in such a way that not HTML link, such as <a href="/directory/file-to-download.ext"> is required? Anything which can be copied an pasted into a browser's address line is what I want to avoid.

  • Have you considered using a download/file manager component?
    – Sharky
    Jan 11 at 6:05
  • I tried to find one, but have not yet seen one which seems to fulfill my needs. Do you know of one that allows me to set the file mode of the "download files" directory to 700, i.e. only the owner has access?
    – phunsoft
    Jan 11 at 9:08
  • 2
    Any component that serves files using PHP instead of direct links should work. jDownloads, OSDownloads and Phoca Download all seem to work this way, at least for local files.
    – Sharky
    Jan 11 at 9:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.