CODEWITHSUNDEEP
phpe-commerce
رامي عبد الله
رامي عبد الله

Reputation: 329

how can i block the user from downloading paid programs with out paying

I want to build e-commerce website with php and I will use omnipay library for paying. The problem is if the file in the url www.mywebsite.com/programs/paint.exe the user can write in his browser that url and the paid program will download..... I searched how to block user from downloading file like RewriteEngine but how can I let the file download if the user paid in this case?

Upvotes: 0

Views: 61

Answers (2)

D. R.
D. R.

Reputation: 334

In addition to using hashed filenames as Peter mentioned, you can use php to serve the file after authentication.

Create an htaccess rewrite to send any requests for the file directly to a php script. In the php script, perform some authentication (I.E. have the user login, or have them use a secured link which sets session variables, etc.). Then, if the user authenticated successfully, use php to return the file using http headers.

header('Content-Type: application/x-msdownload'); // Set this to a .exe
header('Content-Disposition: attachment; filename="paint.exe"'); // Set the filename to download.
$downloadFile = file_get_contents('programs/hashedpaintexename.exe');
echo $downloadFile;

NOTE: You will want to make sure that should you use hashed filenames you'll want your htaccess handle these hashed files as well.

Another option, if you've got the control over the server to do so, is you can have PHP load the file from outside of the website's directory instead of using a htaccess rewrite. For example, if your website directory is /var/www/mywebsite, have php load the executable from /whatever/path/you/want provided php has read-access to the directory.

Upvotes: 0

Peter Juanda
Peter Juanda

Reputation: 96

Maybe you can try these :

  1. Store your program name in hashed format, so instead of www.mywebsite.com/programs/paint.exe maybe it's better in something like this www.mywebsite.com/programs/ca63ff966ff272da14e4fc2e73fcd399. You atleast have store your paid programs in a table and that table should provide its hash formatted name column.
  2. www.mywebsite.com/programs/paint.exe this url should and only accessible by authenticated user. And if it's already authenticated users, you check this user's purchase history, if he/she ever buy this paint.exe program, if there is no record of his/her purchase, you must redirect he/she to your payment page.

Upvotes: 1

Related Questions