I'm looking for a way to provide a "secured" file download for authorized Joomla users (registered user being member of a certain group), but the "link" shall not be usable in any other way, such as copy&paste.
What do I mean by "secured"? It means the access to the file is securely restricted, not the actual file transfer, which is secured by enforcing HTTPS only access to the website.
I'm using something similar on a small non-Joomla web application as follows:
- Files are store in a directory with file mode 700, and files have file mode 600, i.e. only a process running with owner id can physically access the data.
- Apache is configured to run PHP scripts under the owner id of the script.
- PHP scripts and above directory/files belong to the same user (UNIX user, not Joomla user)
- Files are served with the help of some PHP lines as follows:
header("Content-Description: File Transfer");
header("Content-type: " . CONTENT_TYPE);
header("Content-Disposition: attachment; filename=" . USER_FILENAME);
header("Content-Length: " . filesize(SERVER_PATHNAME));
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, pre-check=0");
header("Cache-Control: private", false);
header("Connection: close");
readfile(SERVER_PATHNAME);
I thought I might be able to use above code in a standard Joomla article with the help of Regular Labs Sourcerer extension. This allows PHP code to be run from within an article (or custom module).
Unfortunately, this does not work as expected, because Joomla (of course) has already set the HTTP headers before the PHP code will run. Only the readfile() function is honoured, and will force a download action in the browser. But the browser is receiving a text/html file with the page's HTML code instead of the desired file.
Now to my question: Is there any way to serve a file from a Joomla page in such a way that not HTML link, such as <a href="/directory/file-to-download.ext"> is required? Anything which can be copied an pasted into a browser's address line is what I want to avoid.
