[Resolved] Ideas wanted re: download links

matbennett

I want to write a script to help control downloads on a site that I look after so that users will have to provide a name an email address in order to download.

My initial thought was that the easiest way to ensure that details provided are correct is to email the link to the address given. If I do that though, I have to put something in place to ensure that forwarding that email to a friend won't also allow them to get a copy of the download.

Has anyone done something similar to this, or have some ideas on the best way to do it?

My thought was to create an entry in a table for each registered download that contains a valid-to time, the file location and a unique ID. The user would then be sent a link to a download page with that ID in the URL. The download page itself would check that the time was valid, update the table (to show it had been downloaded) and then serve the file (I assume I can hide the URL by redirecting to the file in the headers).

Really I am jsut posting to see if people think:
1. the above would work
2. there is an easier way

xblue

sounds pretty reasonable to me.

the weakest part may actually the directory where you keep the files. if a user knows the filename since he downloaded it, knows your domain and guesses the path correctly, he would be able to send the link to a friend.

on the other hand, he does have the file, and he could simply distributing it to anyone instead of distributing the link.

matbennett

I was looking at a thread elsewhere that suggests I can hide the location by having the page start the download itself. I may give that a go to see if it gets around that problem.

The emailing isn't a problem. Most of this is designed to negate some of the most hideous bandwidth charges that I have ever seen! The site owner would be more than happy if they start email the files to each other !

Thanks for the feedback.

xblue

then I'd probably put them outside the webdirectory (or protect the directory with htaccess) and read and output the raw content rather than redirecting.

the only problem may be that the filename isn't easy to preserve, I wouldn't know how to solve this.

matbennett

I'll give it a go. Thanks for the input.

xblue

just in case anybody else comes across this: the answer to the filename problem seems to be the content-disposition header. I found an example at zend:
http://www.zend.com/zend/trick/tricks-august-2001.php#Heading3

(almost forgot: credits to Spudgun!)