How To Secure Downloadable Files

[robinsf]

I'm building an application that will allow a group of people to upload and
download files/documents entirely through a web browser. The files need to be
secured using permissions (i.e. different users will have access to different
files depending on the users permissions). Normally, I would use the
Application.cfm file to secure .cfm files but this doesn't work for downloads
since they don't have the ability to reference the Application.cfm file. I've
found an approach for downloading that works by placing the download directory
outside of the web root. The problem is -- how do I upload a document from the
browser to a directory outside of the web root? Can someone recommend an
approach for securing downloads while allowing for uploads from the browser?

thanks,

[blewis]

You are on the right track...you should store files for secure download
outside the web root. As far as uploading goes, it's easy. When you use
CFFILE with the upload option, you can place that file anywhere on the
filesystem you want...it does not have to be in the web root (and should not be
in this case). ColdFusion sees the whole file system, and so CFFILE is not
limited to the web root. Just save the uploaded files whereever you want.

Bryan

[Brian Hogue]

You found the first half of the answer (putting the files outside the web
root). The second part is CFfile and/or CFcontent. Your CF will need to see
the directory path to your downloadable files. I believe that I combined the
CFfile (with read) and the CFcontent examples from Ben Forta's WACK. hth

-brian


"robinsf" <webforumsuser@macromedia.com> wrote in message
news:cvvnjn$2nl$1@forums.macromedia.com...

> I'm building an application that will allow a group of people to upload

and

> download files/documents entirely through a web browser. The files need

to be

> secured using permissions (i.e. different users will have access to

different

> files depending on the users permissions). Normally, I would use the
> Application.cfm file to secure .cfm files but this doesn't work for

downloads

> since they don't have the ability to reference the Application.cfm file.

I've

> found an approach for downloading that works by placing the download

directory

> outside of the web root. The problem is -- how do I upload a document

from the

> browser to a directory outside of the web root? Can someone recommend an
> approach for securing downloads while allowing for uploads from the

browser?

>
> thanks,
>