Snitz Forums 2000
Snitz Forums 2000
Home | Profile | Register | Active Topics | Members | Search | FAQ
Username:
Password:
Save Password
Forgot your Password?

 All Forums
 Snitz Forums 2000 MOD-Group
 MOD Add-On Forum (W/O Code)
 non-url download link?
 New Topic  Topic Locked
 Printer Friendly
Next Page
Author Previous Topic Topic Next Topic
Page: of 3

tribaliztic
Senior Member

Sweden
1532 Posts

Posted - 06 July 2004 :  06:46:58  Show Profile  Visit tribaliztic's Homepage  Send tribaliztic an ICQ Message
I was going through some old bookmarks and found this, did anyone make anything good of this?
http://forum.snitz.com/forum/topic.asp?ARCHIVE=true&TOPIC_ID=48686
I would like to have a file library where there are no links to the files, so that you cannot send a link and have 200 peoples download a movie without going through my site. To just be logged in is not enough apparently.

/Tribaliztic
- www.gotlandrace.se -

tribaliztic
Senior Member

Sweden
1532 Posts

Posted - 11 January 2005 :  09:29:17  Show Profile  Visit tribaliztic's Homepage  Send tribaliztic an ICQ Message
Oops, no answers? Are all of you letting people suck out all of your valuable bandwidth? ;)

/Tribaliztic
- www.gotlandrace.se -
Go to Top of Page

Shaggy
Support Moderator

Ireland
6780 Posts

Posted - 11 January 2005 :  09:50:15  Show Profile
You mean something like what I do on MeTV? (username: test, password: snitz)

What I do is store the URI of each file in the database with a unique id and then use a seperate file to handle the download which can be used to check if the refering link came from your domain, etc.

If this sounds like what you want, let me know and I'll post the relevant file for you.


Search is your friend
“I was having a mildly paranoid day, mostly due to the
fact that the mad priest lady from over the river had
taken to nailing weasels to my front door again.”
Go to Top of Page

tribaliztic
Senior Member

Sweden
1532 Posts

Posted - 11 January 2005 :  11:31:52  Show Profile  Visit tribaliztic's Homepage  Send tribaliztic an ICQ Message
Is there no way to get around that? =)
And do you have a nice page where you insert the url:s?
I'd LOVE to have a look at the code ;)

/Tribaliztic
- www.gotlandrace.se -
Go to Top of Page

Shaggy
Support Moderator

Ireland
6780 Posts

Posted - 11 January 2005 :  12:17:52  Show Profile
No way to get around which bit?
Yeah, I have an admin area on my site where I can add/remove/edit files.
I'll give you a gander if you want but my code ain't exactly reader friendly!


Search is your friend
“I was having a mildly paranoid day, mostly due to the
fact that the mad priest lady from over the river had
taken to nailing weasels to my front door again.”
Go to Top of Page

tribaliztic
Senior Member

Sweden
1532 Posts

Posted - 11 January 2005 :  17:01:34  Show Profile  Visit tribaliztic's Homepage  Send tribaliztic an ICQ Message
Well.. a way to download the files without going via your page with the refferer check I mean..

I code like a maniac, can't follow my own code sometimes so I think I'll give yours a try also ;)

/Tribaliztic
- www.gotlandrace.se -
Go to Top of Page

Davio
Development Team Member

Jamaica
12217 Posts

Posted - 11 January 2005 :  17:17:04  Show Profile
I have my files downloaded using a file id. Like download.asp?file_id=55
I have the script setup to mask the url to the file, so the person only sees he is downloading the file from download.asp?file_id=55 and not the actual location.

I am sure there are ways you can to restrict the downloads only to persons on your site. Like maybe checking the session id. But I haven't really thought about it.

Support Snitz Forums
Go to Top of Page

tribaliztic
Senior Member

Sweden
1532 Posts

Posted - 11 January 2005 :  17:52:40  Show Profile  Visit tribaliztic's Homepage  Send tribaliztic an ICQ Message
As long as any visitor can't just copy the url and post it on zillions of other sites It's fine. We need our bandwidth! =)

/Tribaliztic
- www.gotlandrace.se -
Go to Top of Page

muzishun
Senior Member

United States
1079 Posts

Posted - 11 January 2005 :  21:25:23  Show Profile  Visit muzishun's Homepage
Davio, would you mind sharing the code to do that? I've been considering something like this for a little while now.

Bill Parrott
Senior Web Programmer, University of Kansas
Co-Owner and Code Monkey, Eternal Second Designs (www.eternalsecond.com)
Personal Website (www.chimericdream.com)
Go to Top of Page

Shaggy
Support Moderator

Ireland
6780 Posts

Posted - 12 January 2005 :  06:37:57  Show Profile
tribaliztic, they'll still be able to copy and paste the download.asp?id=x link but, as long as you have a check to see that the link came from your site, you can serve them up an error message. Here's a simplified extract from my donwload.asp file that should point you in the right direction.
if your check here then
	set rs=my_conn.execute("SELECT URL FROM TABLE WHERE ID="&request.querystring("id"))
	if not (rs.bof or rs.eof) then
		server.scriptimeout=720
		set objStream=server.createobject("ADODB.Stream")
		objStream.open
		objStream.type=1
		objStream.loadfromfile server.mappath(rs("URL"))
		response.addheader "content-dispostion","attachment;filename="&mid(rs("URL"),instrrev(rs("URL"),"\")+1)
		response.charset="utf-8"
		select case lcase(mid(rs("URL"),instrrev(rs("URL"))+1))
			case "ext":response.contenttype="mime-type"
			case else:response.contenttype="application/octet-stream"
		end select
		response.binarywrite objStream.read
		objStream.close
		set objStream=nothing
	else
		File not found error
	end if
	rs.close
	set rs=nothing
else
	Referer outside your domain error
end if
As I said, this is an extremely simplified extract meant only to point you in the right direction. If you've got any more queries, let me know and I'll go into more detail when I've a bit more time on my hands.


Search is your friend
“I was having a mildly paranoid day, mostly due to the
fact that the mad priest lady from over the river had
taken to nailing weasels to my front door again.”
Go to Top of Page

tribaliztic
Senior Member

Sweden
1532 Posts

Posted - 12 January 2005 :  10:15:41  Show Profile  Visit tribaliztic's Homepage  Send tribaliztic an ICQ Message
Well, if it's just the refferer check that's the security I can use ordinary links.. Or?

There must be some way to only let logged on users download our files?

/Tribaliztic
- www.gotlandrace.se -
Go to Top of Page

Shaggy
Support Moderator

Ireland
6780 Posts

Posted - 12 January 2005 :  10:23:45  Show Profile
Yep, include config.asp and inc_header.asp at the start download.asp and set download.asp to check if mlev>0. If you're doing this, don't forget to call writefooter at the end of download.asp.

Alternatively, you could set up a password protected directory on your server to hold your downloadable files.


Search is your friend
“I was having a mildly paranoid day, mostly due to the
fact that the mad priest lady from over the river had
taken to nailing weasels to my front door again.”
Go to Top of Page

tribaliztic
Senior Member

Sweden
1532 Posts

Posted - 12 January 2005 :  10:44:59  Show Profile  Visit tribaliztic's Homepage  Send tribaliztic an ICQ Message
So... I (somehow) make a page with links that are masked like davio is talking about, and then make that page check if the user is logged in or not. Then there shouldn't be any way a user can get to the file without going through that page AND clicking on the "hidden" link.. ? =)

/Tribaliztic
- www.gotlandrace.se -
Go to Top of Page

Shaggy
Support Moderator

Ireland
6780 Posts

Posted - 12 January 2005 :  10:55:23  Show Profile
Exactly Only additional thing I'd suggest if you're as paranoid as I am about this would be to give your downloads directory an obscure enough name as anyone who downloads a file will have your domain name and the name of the file, therefore all they'd need for the complete URL would be the directory name - if it has a generic name like "downloads" that's easy to guess, it won't take very long for someone intent on posting your files elsewhere to guess the direct URLs to all your files.


Search is your friend
“I was having a mildly paranoid day, mostly due to the
fact that the mad priest lady from over the river had
taken to nailing weasels to my front door again.”
Go to Top of Page

tribaliztic
Senior Member

Sweden
1532 Posts

Posted - 12 January 2005 :  11:00:03  Show Profile  Visit tribaliztic's Homepage  Send tribaliztic an ICQ Message
Shaggy: Offcourse =)

Davio: do you mind sharing your code?

/Tribaliztic
- www.gotlandrace.se -
Go to Top of Page

Davio
Development Team Member

Jamaica
12217 Posts

Posted - 12 January 2005 :  14:48:45  Show Profile
Here's the code for my download.asp file. It is very similar to Shaggy's own.
<% Option Explicit
Dim id
Dim ConnString, Conn, strSql, rsMod
Dim adoStream, objFSO, objFile
Dim strFilePath, strPhyPath, strFileName, strFileSize, dteModDate
Dim intErrCount

intErrCount = 0

id = Request.QueryString("file_id")

if id <> "" and IsNumeric(id) then
	ConnString = "driver={MySQL ODBC 3.51 Driver};server=*****;uid=*****;pwd=*****;database=*****" '## MySQL
	set Conn = Server.CreateObject("ADODB.Connection")
	
	Conn.Open ConnString
	
	'### Get the path to the file from database
	strSql = "SELECT FILE_PATH FROM MOD_NAME WHERE FILE_ID = " & CInt(id)
	set rsMod = Server.CreateObject("ADODB.Recordset")
	rsMod.open strSql, Conn
	
	'Check if file exists
	if rsMod.EOF or rsMod.BOF then
		ErrorMsg()
		intErrCount = 1
	else
		'Store relative and physical file path in variables
		strFilePath = rsMod("FILE_PATH")
		strPhyPath = Server.MapPath(strFilePath)
	end if
	
	rsMod.close
	set rsMod = nothing
	
	if intErrCount = 0 then
		'if there were no errors, we update the download count for this file,
		'and get the file to begin download
		dteModDate = year(Now()) & doublenum(Month(Now())) & doublenum(Day(Now()))
		
		'### Update database with new download count
		strSql = "UPDATE MOD_INFO SET DOWNLOADS = DOWNLOADS + 1, DOWNLOAD_DATE = '" & dteModDate & "' WHERE FILE_ID = " & CInt(id)
		Conn.Execute(strSql)
		
		Set objFSO = Server.CreateObject("Scripting.FileSystemObject")
		Set objFile = objFSO.GetFile(strPhyPath)
		Set adoStream = Server.CreateObject("ADODB.Stream")
		
		adoStream.Open
		adoStream.Type = 1
		adoStream.LoadFromFile strPhyPath
		
		strFileName = Mid(strFilePath, InStrRev(strFilePath, "/")+1) 'the file name
		strFileSize = objFile.Size 'file size
		
		Response.ContentType = "application/zip" 'type of file they will be downloading
		Response.AddHeader "Content-Disposition", "attachment;filename=" & strFileName & ""  'forces the save/open box
		Response.AddHeader "Content-Length", strFileSize 'optional: send file size to browser
		Response.BinaryWrite adoStream.Read
		Response.Flush
		
		adoStream.Close
		Set adoStream = nothing
		Set objFile = nothing
		Set objFSO = nothing
	end if
		
	Conn.Close
	set Conn = nothing

else
	'call error message when id is empty or is not a number
	ErrorMsg()
end if

function doublenum(Num)
	if Num > 9 then 
		doublenum = Num 
	else 
		doublenum = "0" & Num
	end if
end function
%>

Support Snitz Forums
Go to Top of Page
Page: of 3 Previous Topic Topic Next Topic  
Next Page
 New Topic  Topic Locked
 Printer Friendly
Jump To:
Snitz Forums 2000 © 2000-2021 Snitz™ Communications Go To Top Of Page
This page was generated in 0.26 seconds. Powered By: Snitz Forums 2000 Version 3.4.07