How to check session when downloading uploaded file in cakephp?

Question

Hi there,

I have created a feature to upload and download file in my site. But I want to validate the download feature. I want to allow a user to download file if user is already logged in to my site and given permission to download.

Help me. How to check whether session is present there or not? I am uploading files in /app/webroot/documents/users/ path.

Download link generated is like this : http://localhost/my_project/documents/users/TGlnaHRob3VzZS5qcGcxMjc3ODIzMTAx.jpg

Thank you all.

Answer 1

I would probably set something up so you're not giving them a direct download link. I usually set up an AttachmentsController, with a download() method. Then you can run all the permissions checks you want (and keep stats on the files, etc.)

Answer 2

In that case you can have your controller check the session variable before enabling the download.
If you're using the Session component, you can check the user's status in your users action using something like this:

if($this->Session->read('Auth.User.id'))
{
//download file
}

How you serve your files is up to you though, but that session check should work inside whatever you use to serve the file, such as Travis Leleu's AttachmentsController.

Answer 3

The easiest way to deal with this is to use the AuthComponent for your authentication and the MediaView for handling the download prompt from a "download this file" link on the page.

An Example.

class SomeController extends AppController {
    ...
    public $components = array(
        'Auth' => array(
            ... auth settings ...
        ),
        ...
    );

    public function download( ){
        $this->view = 'Media';
        $this->set( array(
          'id' => 'TGlnaHRob3VzZS5qcGcxMjc3ODIzMTAx.jpg',
          'name' => 'TGlnaHRob3VzZS5qcGcxMjc3ODIzMTAx',
          'download' => true,
          'extension' => 'jpg',
          'path' => join( DS, array(
              APP, 'webroot', 'documents', 'users', ''
          ))
        ));
    }

This assumes you have the download action as a restricted action with regards to the AuthComponent. If you have the download action allowed you can wrap the MediaView code in an Auth->user( ) check like so..

    public function download( ){
        if( $this->Auth->user( )){
            $this->view = 'Media';
            $this->set( array(
              'id' => 'TGlnaHRob3VzZS5qcGcxMjc3ODIzMTAx.jpg',
              'name' => 'TGlnaHRob3VzZS5qcGcxMjc3ODIzMTAx',
              'download' => true,
              'extension' => 'jpg',
              'path' => join( DS, array(
                  APP, 'webroot', 'documents', 'users', ''
              ))
            ));
        } else {
            ... do something else here ...
        }
    }

This just checks that Auth has a valid User object saved to the session. This should only occur when there is a User logged in.

A couple of notes:

I use a blank array entry at the end of the join( DS, array( 'path', 'parts', '' ) call to get the trailing slash required for the path. Do that however you want - I am partial to join myself when building repetitive strings or paths.

http://book.cakephp.org/view/489/Media-Views
http://book.cakephp.org/view/563/Setting-Auth-Component-Variables