Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>I think, by default, the user will be able to download the file either way, from a webroot file path or from a /controller/action path.</p> <p>But this is easy to overcome, with a couple of security implementations.</p> <p>NOTE: in my opinion, if you're using Authorization of some sort, you should hash based on their ['User']['id'] instead of their IP</p> <pre><code>/** * Action to download special assets * example link to download &lt;?php echo $this-&gt;Html-&gt;link('Link Text', array('action' =&gt; 'download', Security::hash('filedownloadsalt'.date('d').env('REMOTE_ADDR')), $filename), array('escape' =&gt; false)); ?&gt; * example URL to download &lt;?php echo $this-&gt;Html-&gt;url(array('action' =&gt; 'download', Security::hash('filedownloadsalt'.date('d').env('REMOTE_ADDR')), $filename)); ?&gt; * @param string $hash * @param string $filename */ function download($hash=null, $filename=null) { // check to ensure that the input hash is specific to this user and created today if (Security::hash('filedownloadsalt'.date('d').env('REMOTE_ADDR'))!=$hash) { $this-&gt;Session-&gt;setFlash("Sorry, you are not allowed access to this asset"); return $this-&gt;redirect(array('action' =&gt; 'failure')); } // check to ensure referrer URL is on this domain if (strpos(env('HTTP_REFERER'), env('HTTP_HOST'))===false) { $this-&gt;Session-&gt;setFlash("Sorry, you must access this asset from within my site, not directly"); return $this-&gt;redirect(array('action' =&gt; 'failure')); } // now get the asset $filenameParts = explode('.', $filename); $filenameExt = array_pop($filenameParts); $filenameBase = implode('.', $filenameParts); $this-&gt;view = 'Media'; $params = array( 'id' =&gt; $filename, 'name' =&gt; $filenameBase, 'download' =&gt; true, 'extension' =&gt; strtolower($filenameExt), 'path' =&gt; APP . 'files' . DS, // don't forget terminal 'DS' 'cache' =&gt; true, ); $this-&gt;set($params); } </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload