PDFs files that can only be accessed by logged-in Joomla Users

Question

I have been searching for hours now and it's time to ask you if there's a solution.

I'm trying to make only logged-in Joomla users can see and download my PDFs in a directory.

For this, I created a .htaccess :

# Adding PDF compatibility for the control
AddHandler php5-script .pdf
php_value auto_prepend_file "prepend.php"

# Check wether or not user is logged-in
php_value include_path "./journal/"
php_value auto_prepend_file "download.php"

I also created a file called "download.php" to check wether or not the Joomla user is loggged-in :

<?php
define( '_JEXEC', 1 );
define('JPATH_BASE', '../');
require_once ( JPATH_BASE .'/includes/defines.php' );
require_once ( JPATH_BASE .'/includes/framework.php' );

/* Create the Application */
$app = JFactory::getApplication('site');

$user = &JFactory::getUser();
if ($user->guest) die();
else {

}
?>

And the last file : prepend.php

<?php

header('Content-type: application/pdf');
readfile($_SERVER['SCRIPT_FILENAME']); // serve the requested file
exit(0);

?>

Problem is, when I try to access to one of the pdf, I get the plain text version of it. Here's the first lines... And it goes long after.

%PDF-1.6 %âãÏÓ 1983 0 obj <>stream hÞì[MoGý+uLÖYŸ‚Fc^†e ÇXŒ¥Ž<°4­ùß/ÉjN„8Y U ìE>oº«Y$«ºÛôà¼ôè DÁ%O2—ß*…¯d¾R}rÙWÙ¡ÏYPq ת ƒ bT#ð.d,‚€Q@JAÁ…*v+DFUg$( 3d½ZcG¢Ï^Pu‚Πѳ¿=£*6\Il ºAƱC1faÆèb z7¹˜A<@¶‘«øÌNÆ’± Y #¶Q•ÃIùØñHÊÇn$¯+±"|!º(^…ĨˆW!;‹x8 ¨ÖBåбÁ¥PÅFô.Å(6"0"±Á?SŠb#J¼Øˆl#'±ÙFAa‰l£Žcµˆ5ž–¨ñ§ dFò’@™‘ÀeH2#¡ËÍ?^~š¦Ï¡èN9PPv9ézSaD:£ºœ³Î`%ÈNTnñËl£Å‡ä¿Ì6Zürt¥Å–?.©Òâ—#_®®4ÿ¸KðrX‚VO+1*BWˆ]®×’´"x %«\Ž\Çz—mHé1bU«¸° Ç6¨ˆ§Õ;.Nñ´#nEÇ*žr¹ÊôZdTõZrœwaæsî„ÝàX‹µ2"GŽÍÊ]"{&×ø[”•Û3b¤s‰mPf.òºJÊŒKq\ñ™$På9B©òÞQÊáyŒ$«ÄIæÒ(‚‚£ÄCEFâ=±Ì)K™Ÿ‘Ä8ìT$ƒÄ’¤Rõ.Ûtƒ8I$Ù'–Q»2Øû,†%ÚX£@)xb©ƒÇ(eAIb±ƒI§1^§‘@õ„õ> %±àŠRH–ïsÃÒƒ|‘’”’—ÞÃP¬I Š5*:€ÿây².I&ÿ‘…IæH¬IáV =‚Ô.I‚¨áeñ$¹§à¶)&d­5JRtÜY%LA¬Isb(Ö¤Š5=èXº/q`(ÝBEŒ ’h!ªµ(Í:ht¸0,:9¦:' *‚ÄSLº n€,U†I¬Fo¬Z%I¬IU3k”uÿfc² ñ4€šFÐë€"PÓ-m%I/IÆ‚ö7’B QŠ˜d§X¦IèYÉÂ+·‚tãï¾Û¼|Òݽ{+¶JÜÜÀùPÀ suÙË®¥@v-b€Á‡Í›íaÚߦ©mw|ñѵ×ÓÃñåôÅÑæí|=½ÚÞ¶ÍQ½ûr;m·ûùvžßÏÞ>ßïçãö¸›÷›óéâ¸y~8î~Ý2Ð_?|ÚûOÓtƒÇÍ»íÕa{³y±»º?Lòóz¾ztÿ§ý%3O›×ò×67‘àßïücÚ^Úî¯wûéüÓV\•¯¶‡ùç›íÕlê·†ü â …Š'”N(ŸP9¡zB¤èüzw95{ï8žç‡æÌÏóáóÇyþ¼ùq¾¸¿áˆë•ß½Óp¾¾¿¹{_ÛáB¦ßH@Óp¾”ŽŸ®§›?Vÿt×—ìQKT´îghÀÊ ¢dÀ­å¼²cFcFcFcFcFcFcFcFcFcFcÆŒ9s0æ`̦$9,À˜ƒ1cŽÆ9s4f¢J`Ìј£1GcNÆœŒ9s2ædÌɘ“1'cNÆœŒ9s6ælÌÙ˜³1gcÎÆœ9s6æbÌŘ‹1ŸZN1æbÌŘ‹1c.Æ\¹³õ99n,À˜«1Wc®Æ\¹3333333333-ÌrºX@Á@4`ؤG¾¨ŒÙ4H¦A2 ’iLƒd$Ó ™É4H¦A2 ’iLƒd$Ó ™É4H¦A2 ’iLƒd$Ó ™É4H¦A2 ’iLƒd$Ó ™É4H¦A2 ’iLƒd$Ó ™É4H¦A2 ’iLƒd$Ó ™É4H¦A2 ’iš?<îÒo®ä´Vulú‹ŽíuÞ²ÿqÞ×sž:üS‡êðOþ©Ãÿ:|;bÿ½†­s°cNè˜ÿöœç×ÇoÎåAå,„o™!ý†åyî¯hŽü<¶û¸uÓ³»ãýån>‹) eî§\L‡ùÁ]^Ü–v”Í]ðöz>§ƒÒ7AR‘ç&ø(YÔ’UÖ!kA¯Ý™ï)ØÒs,,=Ç‚G(ðº–îGÓÒ÷eº8l÷ÿ¾ÛÞÜÝï¯ÔƒÔíÁÈ2jÕ–B{¸›¿MÏ~=Ìû£r l»ÿÚM{wùe¿½Ùýç~:C=Z0h˨~-BeƒÕ܃¤ŽÚ½1מ¹öl̵gc®=síÙ˜kÏÆ\{úùõ¡×“3uoÊ„CÖõœLݽâPçmÖ»ûõTõTu½y'1µ—ÂÃÏÛ;\?üÔ€¾½ÅõÝí |Ùª–÷äq<$ИRÿBzj‡tͪ]³zš€ïš]³úz×÷ÌöBÂz»pn…q•Ó7š‡ýÕyH!,ˆÊz4XBUWüè„Ðz_ÿG @¿JÀ°e×;á!¶€!®HÙº†)Û7+Œ+R¶âô"e«xä~5_N7gKK½Õ®zѧž=<€ûå›^üòmó£¿îÃð["lH ߉¡3éò5<¿$Çö Äq¦V»!3µ’ yœiù¤Þ_´¡®Ò$ãR0´âcäø \Ό㟀pùŒû¿1¬ïVBqÅÞ¼<"Ä{s{¯#ß„¾¢¤F9üyS+ÙXûsÙuºNCï Ú¿Ž‚ñÏ?˜Z õ‚´N-§V%iÅZNµQvŸ¶?|ý¿gÀ=ö¿*ôo, endstream endobj 1984 0 obj <>stream hÞŒË1 €0ЫäéoSmAÜÜ‹õ"ÅEADoov:äÿ^`!8´ä"Aœ§6hKмˆF£t‰žºŽÁèÛșӼðô…óuÞË5leïû?f똫cRÇ|k¾ì`TÔN> endstream endobj 1985 0 obj <>stream hÞŒ“KOƒ@€ç§ÌQÊ.°<’¦IcÓ“QR=øˆ´›º ²»4õ'û'ÔÙbÒ‡¹,³0û}Ìpž¤Èó”a»+G.„|ôƒÄAê‚Ã6(ÂÐFí©c±Å$˜ˆmNŠ©»ã3Z¼™Òƶ.†sï:w;—àv÷µôn[¨Ršñ˜Ò¯ª¦´xÁ™7•Æ>—MQxO”„ÙËŽÇ;xY®eéžn$¾²…<[¹1U‰Zš¼Ù\®Íâ|ë:a¸‘Ûöâù[@‹œ*cµzm¬"îd±Rå dЉ̴\ï*êPBM/od·DÐlö$a¯Ä?%1R¯e£Í ‡èu{Ž¯o˜Ã'CXÀ ”ƒDQ¯(<e IUÓ*Iè”|Ð`â^ø_ãÒ$½šèPsoðN¢5)®(ª¡ Ôº´WïÉfU£KEß×áø9‹Û¬ŽZþüqGødŸåK‰ioƒNaÒcgÄù`D„N

Any help will highly be appreciated!

Answer 1

Ok so I finally got this working. As Marc B also mentioned, my headers was ignored. I guess the double php_value auto_prepend_file didn't work well and the first "prepend.php" was ignored. So I just copy pasted the code and kept everything in one file with the header Conten-Disposition added.

Here's the working code :

.htaccess

# Adding PDF compatibility to check 
AddHandler php5-script .pdf

#Path of the directory where are stored the PDFs
php_value include_path "./journal/"

#Check wether or not user is logged-in & show pdf if logged-in
php_value auto_prepend_file "prepend.php"

prepend.php

<?php

/* Loading Joomla User core Files */
define( '_JEXEC', 1 );
define('JPATH_BASE', '../');
require_once ( JPATH_BASE .'/includes/defines.php' );
require_once ( JPATH_BASE .'/includes/framework.php' );

/* Create the Application */
$app = JFactory::getApplication('site');

/* Check wether Joomla User is logged-in */
$user = &JFactory::getUser();
if ($user->guest) die();
else {

}

/* Sending back pdf */
header("Content-Disposition", "inline; filename=myfilename.myextension");
header('Content-type: application/pdf');
readfile($_SERVER['SCRIPT_FILENAME']); // serve the requested file
exit(0);

?>

Answer 2

You need additional headers in your response - see https://stackoverflow.com/a/2882523/823549 for the full list.

Specifically, Content-Disposition will force the save dialog - http://php.net/manual/en/function.header.php

Answer 3

Try with this in your PHP code:

<?php
header('Content-disposition: attachment; filename=filename.pdf');
header('Content-type: application/pdf');
readfile($_SERVER['SCRIPT_FILENAME']); // serve the requested file
exit(0);

You can also force it using .htaccess:

<Files *.pdf>
    Header set Content-Disposition attachment
</Files>