Protect image and PDF assets in custom fields

[Krlos]

Hello, I'm trying to build a simple Intranet system but I have been stumbling due to my lack of knowledge of Processwire.

I need a very basic functionality, I don't need users to access backend or edit pages or upload content.

I have built everything that is content related using pages, custom fields etc, everything is working fine as Processwire is awesome in this regard.

This is what I'm missing:

I have la 100 users that will read the content of this Intranet, send forms and download files.

I have created 10 custom fields in the system template to hold information (Name, Last Name, Date of Birth, Phone, Cellphone etc), but I also need to add a Profile Photo, and 3 fields to hold a PDF file in each field (Contract, curriculum, and some other internal PDF).

Here are my problem:

I need this 4 fields (PDF and Profile Image) to be secured only accesed by 2 roles (user himself and other more privileged user) and nobody else from outside world.

I've set $config->pagefileSecure = true in the config.php but I'm not sure if I don't understand how to use this or I'm doing it wrong.

As I only need to show the data I have created a front end page called my-profile, in this page I present the currently logged-in user his/her information including Photo profile and the 3 PDFs.

This is where I'm lost:

I have give view access to the custom field profile_image only to Employee (Trabajador in spanish) role

According to how I think it works... when I activated $config->pagefileSecure = true I have restricted access to this custom field only to Employee role, but if I copy the full URL and pasted in another computer I can direct access the photo profile.

What I'm doing wrong?, should I to access manage the template my-profile where I'm displaying this image instead of the profile_image field?

I'm planing to do the same with the PDF files but now I'm not sure if I can make this to work ?

I would appreciate some help

 

 

Edited August 29, 2018 by Krlos
Typo

[mr-fan]

maybe this fieldtype helps?

https://processwire.com/talk/topic/10671-fieldtypesecurefile/

regards mr-fan

[Zeka]

@Krlos Did you block access by guest role for that template? 

[Krlos]

35 minutes ago, mr-fan said:

maybe this fieldtype helps?

https://processwire.com/talk/topic/10671-fieldtypesecurefile/

regards mr-fan

I just found this fieldtype, I will look in to that. Thank you.

[Krlos]

3 minutes ago, Zeka said:

@Krlos Did you block access by guest role for that template? 

No, the profile template is not access managed is by default .

[Zeka]

@Krlos If I'm not mistaken to get pagefileSecure working you should restrict guest access to the template where your PDFs are stored. 

[Krlos]

5 minutes ago, Zeka said:

@Krlos If I'm not mistaken to get pagefileSecure working you should restrict guest access to the template where your PDFs are stored. 

Thank you, I will do that.