FieldtypeSecureFile

[Wanze]

A ProcessWire Fieldtype storing files in a customized location, outside the web root. This module is primarily useful if you need to store sensitive data which should not be accessible directly from the web. Normally, ProcessWire stores all files under /site/assets/files. Direct URL access to these files can be restriced by setting $config->pagefileSecure = true. Still you need to make sure that your template permissions are setup correctly. If something goes wrong, those files could be accessed from outside.

GitHub: https://github.com/wanze/FieldtypeSecureFile

Modules Directory: http://modules.processwire.com/modules/fieldtype-secure-file/

How does it work?

After installing this module, you can create a new field of type SecureFile. Enter your configuration under the "Details" section when editing the field:

• Storage Location Enter a path outside the web root where the files are stored. You need to create the directory manually. Also make sure that the user running the web server has write permission.
• Roles allowing to download a secure file Users with a role selected here are able to download the files if a download is requested via the API.
• Allow Download in Admin If checked, users having a role selected above can download the files when editing a page.

I needed this functionality for a recent project, so I created this module and thought to share it, mabye this is useful for someone else Consider it beta, I'm using it on one site but I'm sure it could be improved here and there. Feel free to suggest additional features!

Cheers

[rick]

This is great! I have one upcoming project in particular where this feature will be necessary.

Thanks for setting this up!

[LostKobrakai]

Very neat and really simple addition. Maybe I'll use it on one of my current projects.

[Macrura]

great! will be really nice for things like invoices, sensitive, or copyright/rights managed data in files

[Martijn Geerts]

Thanks Wanze will come in handy one day!

[Mackski]

I get an error when saving, although it seems to still work.

•  Missing required value (inputfieldClass)

[Mackski]

I also change line 63 in the module to:

$storageLocation = $this->wire('config')->paths->root.rtrim($field->get('storageLocation'), '/') . '/';

So my secure file path is relative to my web root: eg: ../secure_files/

Which is just one level down from my web root, and is easily configured on most shared hosts.
Just saves a bit of time working out absolute paths on shared accounts.

Might be an option within the module to select "Relative path to Processwire root" or "Absolute Path"

[Juergen]

I get an error when saving, although it seems to still work.

•  Missing required value (inputfieldClass)

Got the error too, but it is really only by pushing the saving button.

[Wanze]

Thanks for the feedback guys, I'll look into it.

@Mackski

The option to define the path relative to the root directory makes sense to me, I will add this as an option in the next version.

Cheers

[Juergen]

$secureFile->download(); // Performs the check above and delivers the file via the wireSendFile() function

This opens the file automatically if the page is called. What should be the command to open it only when a link is clicked??

Best regards

[Wanze]

This opens the file automatically if the page is called. What should be the command to open it only when a link is clicked??

I guess you are using the module in the frontend? You will have to implement this logic on your own. A possible solution would be to use a GET variable or a url segment to indicate a download, something like this:

if ($input->get->download == 1) {
  $yourSecureFile->download();
}

[Juergen]

Yep I use it on frontend. I will try your suggestion.

Thanx

[Mackski]

I guess you are using the module in the frontend? You will have to implement this logic on your own. A possible solution would be to use a GET variable or a url segment to indicate a download, something like this:

if ($input->get->download == 1) {
  $yourSecureFile->download();
}

I'm always a bit paranoid, so I check like this:

  // download the secure file
  if($input->get->dl == 1) {
    if($file->name && $file->isDownloadable()) {
      $file->download();
      exit;
    } else {
      // erorr
    }
  }

[Wanze]

@Mackski

Yeah, it's always good to add additional checks. In this situation, $file->isDownloadable() is not necessary, as this check is performed by $file->donwload(). Also ProcessWire's wireSendFile will exit for you if the file was sent

[Juergen]

Is there a possibility to get the size of the file?

Usually I get the filesize like this:

$file       = "path-to-the-file";
$filesize   = (filesize($file) * .0009765625) * .0009765625; // bytes to MB
$filesize   = round($filesize, 2);//rounding 

But in this case it is not possible to use the path to the file.

[adrian]

Is there a possibility to get the size of the file?

Usually I get the filesize like this:

$file       = "path-to-the-file";
$filesize   = (filesize($file) * .0009765625) * .0009765625; // bytes to MB
$filesize   = round($filesize, 2);//rounding 

But in this case it is not possible to use the path to the file.

I am sure Wanze will be able to offer up a solution to get the filesize from the path. I just wanted to chime in with a nice function for converting to human readable filesizes: http://jeffreysambells.com/2012/10/25/human-readable-filesize-php

function human_filesize($bytes, $decimals = 2) {
   $size = array('B','kB','MB','GB','TB','PB','EB','ZB','YB');
   $factor = floor((strlen($bytes) - 1) / 3);
   return sprintf("%.{$decimals}f", $bytes / pow(1024, $factor)) . @$size[$factor];
}

[Wanze]

It's ProcessWire Use:

$pageFile->filename; // Path & Filename
$pageFile->basename; // Filename without path
$pageFile->filesize; // Size in bytes
$pageFile->filesizeStr; // Human readable Filesize

[adrian]

$pageFile->filesizeStr; // Human readable Filesize

I forgot about that - should have remembered there was something built in 

[Juergen]

I forgot about that - should have remembered there was something built it

And I have never heard about that

[Wanze]

@Juergen

Check out the Cheatsheet, you find it under "Files": http://cheatsheet.processwire.com/

[Juergen]

You are right - thanks for the hint.

[Macrura]

It's ProcessWire Use:

$pageFile->filesizeStr; // Human readable Filesize

only issue is i would want the file size to display like 2.97MB but it displays 3,044 kB  using filesizeStr- should i use Adrian's proposed function? would be cool of you could pass some option to filesizeStr to show in MB

[adrian]

only issue is i would want the file size to display like 2.97MB but it displays 3,044 kB  using filesizeStr- should i use Adrian's proposed function? would be cool of you could pass some option to filesizeStr to show in MB

Thanks for reminding me why I didn't use filesizeStr

[Juergen]

Only to mention:

$pageFile->filename; // Path & Filename
$pageFile->basename; // Filename without path
$pageFile->filesize; // Size in bytes
$pageFile->filesizeStr; // Human readable Filesize

This only works if the number of files is set to 1. If it is unlimited (0) only the PW short syntaxes for files (more than 1) work. I ran also into this mistake and I wondered why I didnt got a result.

Maybe you have to use an foreach loop if you have more than 1 file (I have not tried it).

[Vayu Robins]

Would it be possible to get the user ID by whom the file was uploaded by? I really could use this information.