Skip to content

Instantly share code, notes, and snippets.

@shawmanz32na
Forked from hakre/dl-file.php
Last active June 26, 2019 10:08
Show Gist options
  • Save shawmanz32na/8115601 to your computer and use it in GitHub Desktop.
Save shawmanz32na/8115601 to your computer and use it in GitHub Desktop.
Multisite implementation of @hakre 's dl-file.php. All the credit goes to him.
<?php
/*
* dl-file.php
*
* Protect uploaded files with login. Handles the case when a multisite user is valid but doesn't have access to this blog/site.
*
* @link http://wordpress.stackexchange.com/questions/37144/protect-wordpress-uploads-if-user-is-not-logged-in
*
* @author hakre <http://hakre.wordpress.com/>
* @license GPL-3.0+
* @registry SPDX
*/
// We need to use the relative path to wp-load, since this file can live in the wp-includes dir
require_once( dirname( dirname( __FILE__ ) ) . '/wp-load.php' );
// Redirect if user isn't allowed to access this blog/site
global $current_blog, $blog_id;
if (!is_user_member_of_blog( $current_user->ID, $blog_id ) && !is_super_admin() ) {
auth_redirect();
// Uncomment below to return an error instead of redirecting
/*status_header(401);
die('401 &#8212; Unauthorized.');*/
}
list($basedir) = array_values(array_intersect_key(wp_upload_dir(), array('basedir' => 1)))+array(NULL);
// Make sure the requested file exists
$file = rtrim($basedir,'/').'/'.str_replace('..', '', isset($_GET[ 'file' ])?$_GET[ 'file' ]:'');
if (!$basedir || !is_file($file)) {
status_header(404);
die('404 &#8212; File not found.');
}
$mime = wp_check_filetype($file);
if( false === $mime[ 'type' ] && function_exists( 'mime_content_type' ) )
$mime[ 'type' ] = mime_content_type( $file );
if( $mime[ 'type' ] )
$mimetype = $mime[ 'type' ];
else
$mimetype = 'image/' . substr( $file, strrpos( $file, '.' ) + 1 );
header( 'Content-Type: ' . $mimetype ); // always send this
if ( false === strpos( $_SERVER['SERVER_SOFTWARE'], 'Microsoft-IIS' ) )
header( 'Content-Length: ' . filesize( $file ) );
$last_modified = gmdate( 'D, d M Y H:i:s', filemtime( $file ) );
$etag = '"' . md5( $last_modified ) . '"';
header( "Last-Modified: $last_modified GMT" );
header( 'ETag: ' . $etag );
header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', time() + 100000000 ) . ' GMT' );
// Support for Conditional GET
$client_etag = isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) ? stripslashes( $_SERVER['HTTP_IF_NONE_MATCH'] ) : false;
if( ! isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) )
$_SERVER['HTTP_IF_MODIFIED_SINCE'] = false;
$client_last_modified = trim( $_SERVER['HTTP_IF_MODIFIED_SINCE'] );
// If string is empty, return 0. If not, attempt to parse into a timestamp
$client_modified_timestamp = $client_last_modified ? strtotime( $client_last_modified ) : 0;
// Make a timestamp for our most recent modification...
$modified_timestamp = strtotime($last_modified);
if ( ( $client_last_modified && $client_etag )
? ( ( $client_modified_timestamp >= $modified_timestamp) && ( $client_etag == $etag ) )
: ( ( $client_modified_timestamp >= $modified_timestamp) || ( $client_etag == $etag ) )
) {
status_header( 304 );
exit;
}
// If we made it this far, just serve the file
readfile( $file );
@driv3r333
Copy link

This works great if you want to restrict downloading of files.

I have a subfolder inside the uploads folder which has html and pdf files.
I just want to restrict direct access of html or PDF files via url when users are not logged in.

Could you please help me modify this code so that it just displays the html or pdf in the browser instead of prompting the user to download the files?

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment