Member Avatar for kgizo

Good day everyone

I just want to know whether its possible to upload a file using joomla that wouldnt be downloable at all, I tried saving the file as a read only pdf file but that still made the file downloable on the web.

Taking into consideration that the internet is hard to contriol I just want to explore all possble suggestion prior to me concluding that it would be impossible.

Thanks in advance.

  • 5 Contributors
  • 4 Replies
  • 262 Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by Taywin

Dani AI

Generated

Short answer: you can’t make a file truly “undownloadable” if a user’s browser can view it. The realistic goal is to prevent direct public links, require authentication/authorization for every access, and make copying more difficult (watermarks, per-user renders, short-lived links). Choose the goal first — stop casual Save‑As vs. stop a determined attacker — and design to that threat model.

A practical, robust pattern is: store uploaded files where the webserver won’t serve them as static assets, require Joomla authentication/ACL in a delivery controller, then hand the file to the webserver only after checks. Offload the actual byte transfer with X‑Sendfile (Apache) or X‑Accel‑Redirect (nginx) for performance and correct permissions. Example fallback PHP pattern:

// (after confirming Joomla user/ACL)
$file = '/path/protected/document.pdf';
if (!is_readable($file)) { http_response_code(404); exit; }
header('Content-Type: application/pdf');
header('Content-Disposition: inline; filename="document.pdf"');
// Apache mod_xsendfile:
header('X-Sendfile: ' . $file);
// fallback if X-Sendfile not available:
readfile($file);
exit;

Extra measures that raise the bar: dynamically watermark pages or images with username/timestamp; render PDF pages server‑side to images and stream those (harder to reassemble cleanly); issue signed, expiring URLs for any direct links; set no-cache headers and a tight CSP/frame-ancestors policy; always use HTTPS and log access. For very sensitive content, consider commercial DRM or a specialist streaming/viewing service — they’re costly and still imperfect.

Tiebacks: and are right to push server‑side controls and Joomla plumbing; and are right to ask about the use case — pick the protections that match your actual risk.

Recommended Answers

All 4 Replies

Member Avatar for cereal

Hi,

in PHP you could move the uploaded file to a directory outsite public_html, so that is not directly accessible by a remote client, the file then can be served only through a script. If you cannot move it out, then you can use .htaccess rules to limit the access to the defined directory.

However I don't know if Joomla allows such setups. I see they suggest how to block access to some specific files:

But they do not talk about static files, so you may want to search for a well known plugin that can do that or ask their support for a core solution.

Member Avatar for Member #120589

What's the purpose of it not being downloadable? What is it used for?

Member Avatar for Taywin

If it is viewable or clients know exactly what the URL is, it is possible to download the file unless your server has permission set up to access the file. If you are talking about viewing it as PDF but not allow downloading, you may need something similar to Google Book. However, there is still a work around to download the content, just a bit harder to figure out...

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.