I would like to protect files (pdf) that are located in the site/assets/files folder from being downloaded directly via the url that leads to this file. However, when a page containing the file field is called up, it must be possible to make this file available for download.
Is there a solution for this in processwire. The access should be controlled depending on the role of the current user and another parameter.
I tried it like this:
I have protected the folder site/assets/files with .htaccess file:
<FilesMatch "\.(pdf)$">
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order allow,deny
Deny from all
</IfModule>
</FilesMatch>
Then created a template that makes the file path available for download as follows:
<?php if( $ok ) {
header("Content-type:application/pdf");
header("Content-Disposition:attachment;filename=$downloadname" );
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0,pre-check=0");
header("Pragma: public");
readfile("/var/www/...".$download);
}
This works perfectly in a test php file, but when integrated via a template file in processwire it does not work.
My guess is that a header is delivered by processwire, a different content-type or something like that.
In the template I have tried contentType application/pdf and empty, neither works.