leuchtfeuer / secure-downloads
"Secure Download": Apply TYPO3 access rights to ALL file assets (PDFs, TGZs or JPGs etc. - configurable) - protect them from direct access.
Fund package maintenance!
www.Leuchtfeuer.com
Installs: 159 690
Dependents: 0
Suggesters: 0
Security: 0
Stars: 21
Watchers: 13
Forks: 35
Open Issues: 1
Type:typo3-cms-extension
Requires
- php: >= 8.2 < 8.5
- ext-pdo: *
- firebase/php-jwt: ^6.1
- typo3/cms-backend: ^13.4
- typo3/cms-core: ^13.4
- typo3/cms-extbase: ^13.4
- typo3/cms-frontend: ^13.4
Requires (Dev)
- friendsofphp/php-cs-fixer: ^3.10
- typo3/coding-standards: ^0.7.1
- typo3/testing-framework: ^8.0.1
Suggests
- ext-fileinfo: For getting mime types from file path.
Replaces
- bitmotion/secure-downloads: v7.0.1
- typo3-ter/secure-downloads: v7.0.1
- dev-master
- v7.0.1
- v7.0.0
- v6.1.1
- v6.1.0
- v6.0.4
- v6.0.3
- v6.0.2
- v6.0.1
- v6.0.0
- v6.0.0-rc1
- v5.0.6
- v5.0.5
- v5.0.4
- v5.0.3
- v5.0.2
- v5.0.1
- v5.0.0
- v5.0.0-rc1
- v5.0.0-beta2
- v5.0.0-beta
- v4.1.6
- v4.1.5
- v4.1.4
- v4.1.2
- v4.1.1
- v4.1.0
- v4.0.0
- v3.0.3
- 3.0.2
- 3.0.1
- 3.0.0
- 2.0.6
- 2.0.5
- 2.0.4
- 2.0.3
- 2.0.2
- 1.8.0
- dev-release/7.0.1
- dev-feature/TER-273
- dev-release-6.x
- dev-bugfix/TER-271
- dev-tests
- dev-release-5.x
- dev-release-4.x
- dev-release-2.0.x
- dev-release-3.x
This package is auto-updated.
Last update: 2024-12-19 11:35:53 UTC
README
TYPO3 Extension "Secure Downloads"
In TYPO3, assets like PDFs, TGZs or JPGs etc. are normally just referenced by a URL e.g. to fileadmin/...
. The file itself is
delivered directly by the web server, and is therefore not part of the TYPO3 access control scheme – files remain unprotected,
since URLs can be re-used, emailed, Search engine included or even guessed.
The "Secure Downloads" extension (EXT:secure_downloads
) changes this behavior: Files will now be accessed through a script that
honors TYPO3 access rights. The converted URL's will then look like this:
https://www.example.com/securedl/sdl-eyJ0eXAiOiJKV1QiLCJhbGciO[...]vcM5rWxIulg5tQ/protected_image.jpg
This works regardless of where the files come from and is not limited to special plugins, etc.
Since in most cases you will not want to protect everything (which means that everything undergoes rather performance-consuming access right checking), Secure Downloads is highly configurable. You may choose:
- what directories to protect (e.g. you can include typo3temp or not)
- what file types to protect (do you want to protect JPGs or not? etc.)
As a complementary measure, you will of course need to configure your web server not to deliver these things directly (e.g. using .htaccess settings).
Requirements
We are currently supporting following TYPO3 versions:
Outdated Versions
For the following versions no more free bug fixes and new features will be provided by the authors:
- 1) Upcoming release as
leuchtfeuer/secure-downloads
(vendor name changed). - 2) As
EXT:naw_securedl
ortypo3-ter/naw-securedl
.
Installation
There are several ways to require and install this extension. We recommend getting this extension via composer.
Via Composer
If your TYPO3 instance is running in composer mode, you can simply require the extension by running:
composer req leuchtfeuer/secure-downloads:^7.0
Via Extension Manager
Open the extension manager module of your TYPO3 instance and select "Get Extensions" in the select menu above the upload button.
There you can search for secure_downlaods
and simply install the extension. Please make sure you are using the latest version
of the extension by updating the extension list before installing the Secure Downloads extension.
Via ZIP File
You need to download the Secure Downloads extension from the
TYPO3 Extension Repository and upload the ZIP file to the extension
manager of your TYPO3 instance and activate the extension afterwards.
You can also download an archive from GitHub and put its
content directly into the typo3conf/ext
directory of your TYPO3 instance. But please keep in mind, that the name of the folder
must be secure_downloads
(the repository name will be default).
Configuration
After installation you need to configure this extension. Take a look at the corresponding section of the official manual.
Best Practice
You can configure this extension to fit your specific needs. However, here are some "best practices" that may help you when first using Secure Downloads:
- Install this extension as described above
- Create a new "File Storage" of type "Local filesystem" on page 0 of your TYPO3 instance and set the "Is publicly available?" option to false
- Create a directory on your filesystem which matches the previously configured "Base Path"
- Put an
.htaccess
file into that folder that denies the access to all files within and underneath this path - Configure the extension in the admin section of your TYPO3 Backend to match all files (use an astrix for the securedFiletypes option) in your newly created file storage (use the path for the securedDirs option).
Access Configuration
You also need to secure all the directories and file types by your server configuration. This can be done with .htaccess
files.
Some example .htaccess files can be found in the
Resources/Private/Examples
folder.
Note: This extension cannot secure links to files that you include in your CSS file. For example, you can secure /fileadmin
with the default .htaccess_deny
file by putting the file in /fileadmin
. You can allow /fileadmin/templates/
with the
default .htaccess_allow
file by putting this file to /fileadmin/template/
.
Documentation
A detailed documentation can be found in the official TYPO3 documentation of this extension.
Changelog
The changelog can be found in the changelog chapter of the official TYPO3 documentation of this extension.
Contributing
You can contribute by making a pull request to the master branch of this repository, by using the "❤️ Sponsor" button on the top of this page, or just send us some beers 🍻...