how to set downloadable items secure link

[vijaitanarain]

Please could anyone help me in shopping cart. I have a shopping cart where there are downloadable items also. When user orders a downloadable item, he is charged for it. Now I want to know how I send a secure link to user which expires in about 10 days. Also how to store that product so that unauthorized user cannot download it

[planetsim]

Id probably store files like that outside the Web Root and store the information in the database and ask for a few details from the user before downloading can commence of course for that too work you will need to give some information that the actual user can understand and quickly do and make sure they understand why probably in a form of an Email. Of course this isnt 100% safe its safer then having the Files within the Web Root, and no actual questions asked approach although it maybe annoying for some people and this will depend on what you are supplying

[vijaitanarain]

Yes, I get the point but is there any other way to do the same😕

[onion2k]

I'd have a script that passed the file to the user. So, in a basic way:

$file = "this.is.the.real.filename.pdf";

//Some code to check the user is allowed to download the file
if ($_GET['security_token'] == "123abc") {
  header("Content-type = application/pdf");
  readfile($file);
} else {
  header("Location: notallowed.php");
  exit;
}

All the user sees is a link to download.php?security_token=abc123, they never know the real path to the file. Using a database of security_tokens you could easily set it up so that every download has a unique token, and by putting a date when the token is issued you could have them expire pretty easily too just by checking if the date the token was issued is within the last 10 days.

[Ceril]

Yep, readfile is your friend in thoose cases. I would not go with the security tokens thing, I would simply state that:

User X has bought P.pdf in a database.

User X sees:
Your downloadble purchases(1):
P.pdf bought: 22/12 -04 expires: 31/12 -04 Downloaded: 1/5 times.

And when clicking the link. get_file.php check to see that its the right UserID and such in session vs database for the requested item. Upon completed readfile, update downloaded times with +1 so we got a limit on downloads...

Something along thoose lines, hopefully I'am not being all to weird in my explanation.

[vijaitanarain]

Thanks for all the help. I will do exactly what u people have told me to do with downloadable items. 😃

[vijaitanarain]

I am here again. There is a little problem with downloading

Code is :
$file_extension = strtolower(substr(strrchr($filename,"."),1));

if( $filename == "" )
{
echo "ERROR: download file NOT SPECIFIED. ";
exit;
} elseif ( ! file_exists( $filename ) )
{
echo "ERROR: File not found. ";
exit;
};
switch( $file_extension )
{
case "pdf": $ctype="application/pdf"; break;
case "exe": $ctype="application/octet-stream"; break;
case "zip": $ctype="application/zip"; break;
case "doc": $ctype="application/msword"; break;
case "xls": $ctype="application/vnd.ms-excel"; break;
case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
case "gif": $ctype="image/gif"; break;
case "png": $ctype="image/png"; break;
case "jpeg":
case "jpg": $ctype="image/jpg"; break;
case "txt": $ctype="text/plain";break;
default: $ctype="application/force-download";
}

$emrfiletype = $type[$file_extension];

I get in doc files:
c:/style/style.css does not exist

and in gif or jpg files no image is displayed althoug they are downloaded

😕