Welcome, Guest
Username Password: Remember me
Joomla!Day USA West | October 1-3, 2010

[Unsolvable] How to secure files attached to posts in a forum only accessible for registered users?
(1 viewing) (1) Guest
  • Page:
  • 1

TOPIC: [Unsolvable] How to secure files attached to posts in a forum only accessible for registered users?

[Unsolvable] How to secure files attached to posts in a forum only accessible for registered users? 6 months, 3 weeks ago #1

Hi,

I have installed Kunena in a closed section of my Joomla site to which only registered users have access.

I now notice that when those users attach files to posts, these files are accessible without registering once you know the name of the file, because the standard directory in which these attachments are stored by Kunena is not protected (/media/kunena/attachments/legacy/files/[name of the file]).

How can I solve this?

/Gompie
  • Gompie
  • OFFLINE
  • Fresh Boarder
  • Posts: 6
Last Edit: 5 months, 1 week ago By sozzled. Reason: Topic closed
The topic has been locked.

Re:How to secure files attached to posts in a forum only accessible for registered users? 6 months, 3 weeks ago #2

Hello,

With a bit of search, you can find anything : www.kunena.com/forum/advsearch?q=hide+at...=1&childforums=1
  • xillibit
  • NOW ONLINE
  • Kunena Developer
  • Kunena for ever
  • Posts: 3221
I don't provide support by PM, because this can be useful for someone else.
Become a Kunena fan
The topic has been locked.

Re:How to secure files attached to posts in a forum only accessible for registered users? 6 months, 3 weeks ago #3

Hi,

Ok, thanks (and sorry: must have used wrong search terms), but: I installed the 1.5.7 patch (I am still running the 1.5.7 version) and found the new configuration items in the backend (show images/attachement for guests = 'no'), but the files are still available; is this only valid for new posts or what?

/Gompie
  • Gompie
  • OFFLINE
  • Fresh Boarder
  • Posts: 6
Last Edit: 6 months, 3 weeks ago By Gompie.
The topic has been locked.

Re:How to secure files attached to posts in a forum only accessible for registered users? 6 months, 3 weeks ago #4

Hi,

I have upgraded to 1.5.9 now, but it's still not working (using the 1.5.7. patch)...

Any ideas?

/Gompie
  • Gompie
  • OFFLINE
  • Fresh Boarder
  • Posts: 6
The topic has been locked.

Re:How to secure files attached to posts in a forum only accessible for registered users? 6 months, 3 weeks ago #5

Hi

Installed the 1.5.8 patch now over the 1.5.9 and even tried the Dutch 1.5.9 Ultimate version as suggested, but still no solution (the Dutch 1.5.9 Ultimate version even gave an error in a language file after installing, apparently the uninstall doesn't really delete everything), but I guess those patches suit their purpose, but not mine: it all comes down to the fact that Kunena stores attachments to posts in a public Joomla directory /media/kunena/attachments/legacy/files and there's no way to change that ...

/Gompie
  • Gompie
  • OFFLINE
  • Fresh Boarder
  • Posts: 6
The topic has been locked.

Re:How to secure files attached to posts in a forum only accessible for registered users? 6 months, 3 weeks ago #6

I haven't tried this myself yet because I never had any need for it, but here is what I think can work for you:

Prevent direct (hot) linking to files in your .htaccess file. This requires visitors to view the files inside the forum. You can apply this "trick" to other Joomla! components as well.

Lots of examples on how to configure an htaccess file contain a section for disabling hot linking.

That's the first one Google spits out: www.javascriptkit.com/howto/htaccess10.shtml
  • Theo01
  • OFFLINE
  • Junior Boarder
  • Posts: 22
The topic has been locked.

Re:How to secure files attached to posts in a forum only accessible for registered users? 6 months, 3 weeks ago #7

Hi,

Thanks, I already tried that, but that means that registered users, once inside the forum will have to use an extra login to get access to those files also and that's a bit annoying ...

/Gompie
  • Gompie
  • OFFLINE
  • Fresh Boarder
  • Posts: 6
The topic has been locked.

Re:How to secure files attached to posts in a forum only accessible for registered users? 6 months, 3 weeks ago #8

Hello,

I don't undserstand where is the source of the issue, but you can try the changes that i have made for K1.5.9 :

File Attachment:

File Name: hide_attachments_guests.zip
File Size: 78601
Attachments:
  • xillibit
  • NOW ONLINE
  • Kunena Developer
  • Kunena for ever
  • Posts: 3221
I don't provide support by PM, because this can be useful for someone else.
Become a Kunena fan
The topic has been locked.

Re:How to secure files attached to posts in a forum only accessible for registered users? 6 months, 1 week ago #9

Hi,

Thanks, I upgraded, but the problem remains ...

The issue is this: http://www.cannedit.net/media/kunena/att...egacy/files/test.doc

I know: it only works in case you have the exact filename, but still ...

Kunena should in my opinion not store attachments in a subdirectory of a public Joomla directory and should at least offer in the configuration panel in the backend the opportunity to change the standard directory for storing attachments.

/Gompie
  • Gompie
  • OFFLINE
  • Fresh Boarder
  • Posts: 6
Last Edit: 6 months, 1 week ago By Gompie.
The topic has been locked.

Re:How to secure files attached to posts in a forum only accessible for registered users? 6 months, 1 week ago #10

If, the user know the link he can download it, but i think there are no ways to prevent this.
  • xillibit
  • NOW ONLINE
  • Kunena Developer
  • Kunena for ever
  • Posts: 3221
I don't provide support by PM, because this can be useful for someone else.
Become a Kunena fan
The topic has been locked.
  • Page:
  • 1
Time to create page: 0.36 seconds