Problems, need help? Have a tip or advice? Post it here.
6 posts Page 1 of 1
hello, I've been searching the forum to try to pin down the procedure for keeping uploaded files secure. My client will be uploading .mp3 and .wav files for site visitors to play on the website and for logged in visitors to download. We want to protect the files from downloading by anyone other than a visitor logged in to a specific part of the website.

I've been looking at using couch/uploads/file/secure - but having uploaded files into that folder the audio player will not play the audio files. Should I be using editable type 'securefile' or is that just for uploading of files from the front end?

Should I be using cloak_url in tandem with another method - e.g. .htaccess or file permissions? Sorry but the more I've searched the forum the more confused I've become about what is the best thing to do. Thanks in advance for your advice!
hello ... still not sorted out this aspect of the website - keeping uploaded audio files secure whilst allowing them to be played on the site with audio player. Any advice would be much appreciated!
I'd stick to securefile concept.
Playing via audio player probably depends on the provided path to the file. Did you happen to try tag 'cms:securefile_link' for this purpose? It's parameters are: 'id', 'thumbnail', 'physical_path'.

Allow me to try and clear your confusion about securefile and cloak_url. This could also help others facing the same questions.

As you know, allowing visitors the capability of uploading files to your server is always fraught with risk.
The type 'securefile' editable regions tries to mitigate this -
a. by subjecting the uploaded file to rigorous tests based on what extensions, size etc. have been allowed
b. by randomizing the name of the uploaded file

So, securefile is meant to be used only for *uploading* files securely.

Now comes the reverse direction - i.e. *downloading* the files securely.
When you don't want the visitor to know the location of the file she is downloading (or wish to allow only certain users to download the file etc.), we use the <cms:cloak_url> tag (

I'd like to stress one point here -
the file being securely downloaded could be the one we securely uploaded using the type 'securefile' region above
*or* it could be an ordinary file uploaded by a trusted user (admin usually) using type 'file' editable region.

OK, hopefully that would have made clear that securefile is for securely uploading and cloak_url is for securely downloading.

We can now discuss your particular use-case.
You wish to have secured mp3 files available for only registered user.

1. How to upload?
Your choice is between using type 'file' or type 'securefile'.
Since the files will be uploaded to the server by the admins using the admin-panel (as opposed to being submitted from the front-end by visitors), type 'file' is the clear choice. Just make sure to upload the files in the 'uploads/file/secure/' folder.

2. How to download?
You are actually trying to play the files through HTML5 Audio player but that is also downloading.
Since this is to be done securely (not revealing the real name/location of the file and allowing only registered user to do so), there is only one option - use cms:cloak_url

As an example, suppose your type 'file' editable region is named 'my_audio', the following would play the file without revealing its location -
Code: Select all
<audio controls="controls">
    Your browser does not support the <code>audio</code> element.
    <source src="<cms:cloak_url link=my_audio />" type="audio/mpeg">

Assuming you are using 'extended users' module for user accounts, for further enforcing that only the current logged in user is able to play/download the files, first make sure that the page displaying the player above is access-controlled (i.e. allowing in only registered users) and then use the 'user_id' parameter of <cms:cloak_url> as follows
Code: Select all
<audio controls="controls">
    Your browser does not support the <code>audio</code> element.
    <source src="<cms:cloak_url link=my_audio user_id=k_extended_user_id />" type="audio/mpeg">

Using 'cms:securefile_link' would reveal the real path of the file (in the HTML source) hence won't be an option in this use-case.

Hope this helps.
... apologies for not responding to your lengthy and helpful reply - I didn't appear to get a notification of the posting ... I'll read through in detail, thank you
... I've now tried out the method for keeping audio files secure - and it worked fine on localhost.

At first I had a problem after migrating the change to the host's server - the error
Failed to load resource: the server responded with a status of 404 (Not Found)

After a bit of investigation I amended the names of my client's audio files to get rid of the spaces and it works OK now ...

6 posts Page 1 of 1

Who is online

In total there are 5 users online :: 1 registered, 0 hidden and 4 guests
(based on users active over the past 5 minutes)

Users browsing this forum: Exabot [Bot] and 4 guests