Notifications

Clear all

[Solved] Secure attachments

wpForo Advanced Attachments

Last Post by umar 3 years ago

9 Posts

2 Users

1 Likes

960 Views

RSS

Posts: 5

umar

Topic starter

Dec 30, 2020 10:45 pm

(@umar)

Active Member

Joined: 3 years ago

Hello,

"I want to know, is there any way to protect the attachments.

That's good only logged in users can download, but direct download link is visible for logged-in users. They can share/reuse.

How to protect attachments direct link visibility for logged in users.? /Thanks"

Ask same question on WPforo: https://wpforo.com/community/how-to-and-troubleshooting-2/attachment-protection/

Now I purchased "Advanced attachment" addon, enabled "Secure Attachment URLs" this just changed url structure. Still unsafe, logged-in members can copy attachment url and reuse anywhere...

Topic Tags

attachment secure attachment

8 Replies

Posts: 4172

Tom

Admin

Dec 31, 2020 10:49 am

(@tomson)

Famed Member

Joined: 9 years ago

Hi @umar,

The secured attachment URL will not work for others. It only works for the usergroup you've enabled the "Front - Can access to attachments" permission.

So if this permission is disabled for Guests usergroup, then a visitor cannot download the attachment.

Posts: 5

umar

Topic starter

Dec 31, 2020 4:06 pm

(@umar)

Active Member

Joined: 3 years ago

Posted by: @umar

That's good only logged in users can download, but direct download link is visible for logged-in users. They can share/reuse.

How to protect attachments direct link visibility for logged in users.?

That's my Question!

Disabled for guest group, enabled for "Subscribers" group so logged-in users can download.

The issue is the direct link of attachment is visible for logged-in users they can download these attachments and also can copy attachments link and reuse anywhere. (Really not good for small business having shared hosting with limited resources).

6 Replies

Tom

Admin

(@tomson)

Joined: 9 years ago

Famed Member

Posts: 4172

Jan 01, 2021 1:49 pm

Reply to

umar

@umar,

they can download these attachments and also can copy attachments link and reuse anywhere

The link will not work for those who is not logged in and doesn't have the appropriate accesses. Again, having the link doesn't mean they can download it. The link is a PHP link, and it checks current user who try to download and doesn't allow.

umar

(@umar)

Joined: 3 years ago

Active Member

Posts: 5

Jan 01, 2021 9:15 pm

Reply to

Tom

@tomson

Please check: https://www.screencast.com/t/D6y2IQZSPd

Attachment link: https://www.whichquery.com/vu/forum/dl/0b4f16d1dd214ed13e89e98bf1065b9f/

Tom

Admin

(@tomson)

Joined: 9 years ago

Famed Member

Posts: 4172

Jan 01, 2021 9:38 pm

Reply to

umar

@umar,

Please show me the Guest Usergroup permissions screenshot and the forum "Papers (Mid/Final)" permissions settings screenshot.

umar

(@umar)

Joined: 3 years ago

Active Member

Posts: 5

Jan 02, 2021 9:52 pm

Reply to

Tom

@tomson

usergroup "Guest" :

Permission for ZOO507 "Papers (Mid/Final)"

Tom

Admin

(@tomson)

Joined: 9 years ago

Famed Member

Posts: 4172

Jan 02, 2021 11:50 pm

Reply to

umar

@umar,

So, I see, the "Can access to attachments" is enabled for Guests. What else do you want?? If you don't want them to use a direct link and download attachments you should disable this permission. How are you going to protect your attachments if you let them download?