Hiya,

This module is really great and I very much appreciate all the work that has gone into it. :)

One thing I can't figure out is how to block non logged-in users from viewing files if they happen to know the URL.

For example:

http://members.outaouaisiww.org/drupal/files/webfm/Welcoming/kitten/colo...

I don't need logged-in users to have different rights, I can see a couple of responses to that. Jsut that folks should need to be logged-in.

I saw something vague about htaccess in the documentation but am not sure where to go from there?

Joy,
Gwen

Comments

robmilne’s picture

robmilne commented

The following are the top three hits on google for '.htaccess':
http://www.javascriptkit.com/howto/htaccess.shtml
http://httpd.apache.org/docs/1.3/howto/htaccess.html
http://www.freewebmasterhelp.com/tutorials/htaccess/

If the files you want to protect are in webroot/files/webfm, then place the .htaccess in that directory and the .htpasswd above webroot so that no prying eyes can see it. Once in place and functioning properly, only logged in users with 'see webfm attachment' rights will be able to download a file via webfm_send. Download via file path won't be possible unless they know the password.

Stripey’s picture

Stripey commented

thanks for your advice!

Alright I followed the instructions on this page: http://www.javascriptkit.com/howto/htaccess3.shtml

I made an htaccess file containing

AuthName "Restricted Area" 
AuthType Basic 
AuthUserFile /.htpasswd 
AuthGroupFile /dev/null 
require valid-user

and put it in webfm folder

I created an .htpasswd file and put it above the www folder on the server. but I still seem to be able to see the kitten when not logged in.

How does htaccess know if someone is logged in or not?

Stripey’s picture

Stripey commented

Actually I was mistaken (cached). It works fine. Cheers!

robmilne’s picture

robmilne commented
Status: Active » Closed (fixed)
somebodysysop’s picture

somebodysysop commented

Has anyone else noticed that in a "private" file system, if you use .htaccess to deny access to:

files/webfm/yourdirectory/yourfile

it can *still* be bypassed by:

system/files/webfm/yourdirectory/yourfile

.htaccess =

order allow,deny
deny from all

kmv’s picture

kmv commented

it can *still* be bypassed by:
system/files/webfm/yourdirectory/yourfile

Is this only a D5 problem? I can't seem to replicate on D6.

In any case, I recommend you move the DENY out of .htaccess and into a pair of location descriptors in the correct HTTPD '.conf' file for your host / virtual host.

The exact location of the correct file will depend upon how you have set up your system, but I'd guess that most people will be on a virtual host, and that it will be defined in a file found in /etc/httpd/conf.d

Which would mean that...

<VirtualHost [your ip address]:80>
    [... the existing host config ...]

    <Location /files/webfm/yourdirectory>
        AllowOverride None
        Options None
        Order allow,deny
        Deny from all
    </Location>

    <Location /system/files/webfm/yourdirectory>
        AllowOverride None
        Options None
        Order allow,deny
        Deny from all
    </Location>
</VirtualHost>

That should fix it for you.

somebodysysop’s picture

somebodysysop commented

Thanks for the advice. httpd.conf does seem like a better place for the DENY.

Is this only a D5 problem? I can't seem to replicate on D6.

I'm running D6. If your file system is "Public", you probably won't be able to duplicate the problem. It happens when the filesystem is set to "Private". I supposed since Drupal doesn't know anything about the files (they aren't in any file table other than webfm), it allows access. I wrote some code to address this here: http://drupal.org/node/493430