Prevent 'the world' from accessing members PDFs in an Umbraco CMS

Question

Hi All

I am new to Umbraco and have inherited an existing site 3-4 years old. One of our users has just come to me and asked why her members only PDFs are freely available if Googled by name, but their containing folder in Umbraco is not - ie she has to log in to get to the folder.

Within the Umbraco Admin system I can see how to set permissions for the pages but not for individual files

Can I set permissions within Umbraco so that this cannot happen, or is it basic file permissions on the server of some sort?

I have posted this on the Umbraco forum but so far had no replies!

Hopefully somebody has an answer

Best regards

Dave

Answer 1

Hi, this is the exact reason why I submited an issue tracker.

Umbraco as far as 4.5.1 goes has no File Permission controls. The files are stored in the Media Folder, and therefore are always publicly available.

I have created a HTTPModule that allows you to control the permission on those media files. Please take a look here. Click here.

Only problem with this method is: 1) Only work on IIS7 2) The application pool has to run on Integrated Mode.

Please note that is not the full implementation. If you need help to get it working, feel free to ask me for more help here.