Secure Downloads in Expression Engine
This tutorial covers using two free plugins for Expression Engine, File Upload & Lock Download, to create a secure area for sharing files with members of your EE site. At the conclusion of this tutorial, you will have created a system whereby administrators can easily upload files to a folder, and members logged into the site will be able to download files without actually being able to see the true URL of the file.
This tutorial should take approximately 30-45 minutes to complete.
1. Download the File exension for Expression Engine
Download the File extension from Mark Haut’s website.
2. Upload the necessary files to your EE installation and activate the extension
As discussed on the plugin’s website, upload ext.mh_file_ext.php to your system/extensions directory, Upload lang.mh_file_ext.php to your system/lang/english directory, and upload the icons folder to your images directory.
Activate the plugin by going to Admin > Utilities > Extensions Manager
3. Choose a folder to upload the files to
Create a folder in your root directory to hold all of your downloadable files. It would be a good idea to name the folder something that is not easily guessed. In this tutorial, I’m going to use a folder called download_folder_name, but you can choose whatever you like. Go ahead and upload the folder to the server using the FTP program of your choice.
4. Edit the upload location in the control panel
Navigate to Admin > Weblog Administration > File Upload Preferences and click on the button to create a new upload destination. Choose a descriptive name for your directory, enter the server path to the folder you just created, and enter the URL for your upload directory.
Since I’m creating a way for individuals to share PDF files, I’m going to make sure to choose All file types in the Allowed File Types field.
That’s it for the File extension right now. We’ll add a custom file upload field to your publish form a little later in the tutorial.
Tip - You can find your full path information by opening your control panel and clicking Admin > System Preferences > General Configuration.
5. Download the Download Lock module for Expression Engine
Download the Download Lock module from www.media-cow.com. Please note that you will be requred to register at the site before you can download.
6. Edit settings in mod.download_lock.php
After you’ve downloaded and extracted the download_lock.zip, go ahead and open mod.download_lock.php in the text editor of your choice. Although you have access to several settings here, in this tutorial we are only going to change one. Edit the download_path variable to include the full path to the folder you just created to hold your secure downloads. In this tutorial, my path is /Applications/MAMP/htdocs/download_folder_name/.
7. Upload files and activate plugin
Follow the instructions on the media-cow website for acivating the plugin:
Now upload the lang.download_lock.php file to system/lang/english/ and the download_lock folder (containing two files) to your system/module/ folder. Go to Modules and enable the module and you’re good to go.
You know everything worked according to plan when you see the Installed in nice, green letters in the modules tab of your control panel.
8. Create a new weblog for posting links to files
In the EE control panel, click Admin > Weblog Administration > Weblog Management > Create a New Weblog. Name the weblog whatever you want (i’m going to call mine super_secret_downloads) and then head on over to the Field Groups section of the admin panel to create a new set of fields for our new blog. I’m going to keep my download page simple, so I only need to add two field besides the default Title and URL Title fields.
The first field will contain the name of the file you’re planning on sharing. I’m calling my field my_file. Choose Text Input for the field type.
The second field will be the actual file upload field. Choose File for the field type and choose the name of the upload location you created earlier in the tutorial for the upload location.
Once you’ve finished creating your custom webglog fields, head back to the weblog manager section and assign the new field set to the weblog you created earler in this step.
9. Create your download page template
Not that we’ve created the necessary weblog and custom fields, it’s time to display a list of the downloadable files. Create a new template of your choosing and use the following code an an example to setup your list.
<html>
<body>
{exp:weblog:entries weblog="super_secret_downloads"}
<h3>{title}</h3>
{if logged_in}<a href="{exp:download_lock:link entry_id="{entry_id}" field_name="my_file"}">Download</a>
{if:else}You must be logged in to download.{/if}
{/exp:weblog:entries}
</body>
</html>
You can certainly jazz up the template to match your site template, but for now I’m just going to keep everything simple. The above code simply looks through the list of entries in your download blog, listing the title of each post as a header and placing a link to download the file under the header. The actual file location will be hidden from the user and anyone not logged in would simple see text reminding them “You must be logged in to download.”
10. Test the system
Let’s test everything out and make sure it works according to plan. We’re going to go through the whole process of uploading and downloading a file to make sure that everything is working correctly.
11. Upload a file
In the control panel, choose Publish and select the blog you created to hold your secure downloads. Enter a descriptive name in the Title field, the file name in the my_file field, and choose the file you want to upload in the File field.
Click Submit when you’re finished.
12. Test the file download page
Now that we have created a post and uploaded a new file, we need to make sure the download page correctly lists and links to our files. Head on over to the template you created and let’s see what we have. You should see something that looks like the image above. Hover over the link to see that it does not point to the actual URL of the file.
13. Log out and try the page again
Everything should be working smoothly at this point, but there’s one more thing we need to check out first. We need to make sure that only individuals logged into the site are allowed to download the file. So, let’s logout of the system and visit your template once again. This time, you should not see the download link, only some text telling you that you need to login in order to download the file.
14. Conclusion
That’s it for now. From here, you could certainly go back and spend some time styling the actual download page or create a member login form for the page. You might also want to add a few other custom fields to the publish form for displaying information such as date the file was uploaded, a short description of the file, or the number of times each file has been downloaded.
6 Responses »
Trackbacks
Leave a Response
Entries(RSS)
Hi Brandon,
I have an EE site in development. This and your iphone tutorial are GREAT! I like the secure downloads idea. However my members will need a secure downloads area per member. My members are real estate sales customers. So I need to be able to get them for example real estate contracts. and docs. But have access has to be limited to just that member. Does that make sense? Could your strategy work in this way?
Kind regards, Mike
Hi Mike,
Thanks for the compliment! Depending on how many members you have, you might be able to get this method to work by creating a different group for each individual member. You could detect which group a member belongs to and show only downloads assigned to that group. If you have more than a few members at a time, it might be best to use something besides EE to deliver files to those members. If you haven’t checked out box.net, I would highly recommend it for file sharing. I’ve also been using an open-source project management system called Collabtive and have been really impressed with it so far. Here’s a great tutorial for setting that up if you’re interested!
Let me know if you find a better solution . . . I’m about to start developing a site that will require similar functionality and I would like to hear which approach you choose!
Hi Brandon,
Thank you for the kind reply and I apologize for not getting back to you sooner. I have not found a solution yet. I think for now I will just use EE pm amd email features with attachments to get docs to my members/customers. The docs will be mostly real estate contracts and related docs via pdf files and the file size is pretty small.
The draw back is I was wanting a solution to where the customers could just click on a file link and view the doc in the browser as opposed to having to download and save to their local hard drive.
I’m not sure how having a group for each customer would work… I might have 300+ customers…that would be a lot of groups to!
Please let me know what you end up with. If you want to you can email me directly.
Kind regards, Mike
Hello there I have just been onto your website tutorial and tried to download the following link http://media-cow.com/downloads/ but I get the following error
Error
The following tag has a syntax error:
{exp:cron}
Please correct the syntax in your template.
can you please help at all because i think your solution will solve my problem
Thankyou
@stuart Hello! I’ll be happy to take a look. The code works fine on my server, so it may be something in your template. Can you post some more of the code you’re using in your template?