Help with securing my downloads and...

ProgrammerNoob

Sorry, but i am kind of a noob at this php programming, i mean i can do ruby programming, but this is a little more complicated. My problem is that i can't seem to make it so i can encrypt a download and make it so people have to buy my item first, then they can download it, but can only download it once...can anyone help me with that? thanks...

cgraz

Store your files in a main repository and use a database to keep track of the files (unless there's only a few)
Deny all access to that folder using a .htaccess file so nobody can download your files directly
Create a PHP script (download.php?file=4) that will allow users to download the file if they have the proper privileges.

Now all you have to do is assign those privileges. When they pay, flag them as allowed to download that particular file. When download.php runs, check that that user has access to download the file. If so, give them the file, then remove the flag from the database so they can no longer download.

ShawnK

the only improvement that could be made to the above idea is that if you have root access you could create a folder outside of htdocs or www, or whatever your doc root is and store the downloads there

MarkR

ProgrammerNoob wrote:
i can't seem to make it so i can encrypt a download...

If you feel you need to encrypt a download, run the site off HTTPS. That is the only reasonable way, and really easy.

and make it so people have to buy my item first, then they can download it, but can only download it once...can anyone help me with that? thanks...

That is a totally independent issue.

You could have a PHP script be used for downloading, and make that require authentication. Only allowing them to download it once is a pretty pointless restriction, as their connection may break during the download, etc. You could consider giving them a limited time to download it however (and make sure you have auditing to prevent account sharing etc).

You have to ask yourself WHY this requirement exists. I suspect no such requirement does exist. Look at your project's requirements in more detail. Decide whether they are reasonable and feasible, take it up with your client / manager.

In any case, there is absolutely nothing you can do to stop them sending the file to all their mates and/or sticking it straight on their favourite P2P network, selling CDs etc. A discussion of how to prevent this (or whether it's desirable at all) is really to do with DRM, and highly technical and legally complex and well out of the scope of this forum.

Mark

ProgrammerNoob

Thanks a bunch for all of the posts. They have really helped me... Btw, this might be a little funny, but i am only 13 🙂 my dad wants me to learn PHP so i can help him with his businesses... :-) just thought that might be a little interesting. Talk to all of you later if I have more problems.