SecureDownloadPlugin

Secure, temporary download links

This plugin is inspired by mod_secdownload of Lighttpd. It creates a secure download area only accessible via unique download URLs that only remain valid for a specified time. This is most convenient when protecting downloadable resources with a registration form that has to be filled out before access to them is granted.

Examples

You type:

%IMAGE{
   "zoology_nasc_bc.jpg" 
   topic="%SYSTEMWEB%.SecureDownloads" 
   size="200" 
   href="%SECURL{"zoology_nasc_bc.jpg"}%"
}%

You get:

%IMAGE{ "zoology_nasc_bc.jpg" topic="System.SecureDownloads" size="200" href="%SECURL{"zoology_nasc_bc.jpg"}%" }%

Installation Instructions

You do not need to install anything in the browser to use this extension. The following instructions are for the administrator who installs the extension on the server.

Open configure, and open the "Extensions" section. "Extensions Operation and Maintenance" Tab -> "Install, Update or Remove extensions" Tab. Click the "Search for Extensions" button. Enter part of the extension name or description and press search. Select the desired extension(s) and click install. If an extension is already installed, it will not show up in the search results.

You can also install from the shell by running the extension installer as the web server user: (Be sure to run as the webserver user, not as root!)

cd /path/to/foswiki
perl tools/extension_installer <NameOfExtension> install

If you have any problems, or if the extension isn't available in configure, then you can still install manually from the command-line. See https://foswiki.org/Support/ManuallyInstallingExtensions for more help.

Before using this plugin make sure you properly configured it:

1. Make sure your web-server has got the xsendfile protocol activated. See also Foswiki:Extensions/XSendFileContrib
2. Specify a secure download area in Foswiki::cfg{SecureDownloadPlugin}{DownloadArea}
3. make sure the download area is VIEW restricted
4. Configure the timespan that a download url is valid in $Foswiki::cfg{SecureDownloadPlugin}{Timeout}
5. Config a secret to be added to the download token in $Foswiki::cfg{SecureDownloadPlugin}{Secret}
6. Optionally sepcify a topic or url in $Foswiki::cfg{SecureDownloadPlugin}{Redirect} to redirect to once a download token expired

Dependencies

Name	Version	Description
File::MMagic	>0	Required
Foswiki::Contrib::XSendFileContrib	>0	Optional

Change History

11 Jun 2018	fixed Secret parameter in Config.spec
08 Jun 2016	initial release