| |
scollins
|
 Posted: Mon Oct 22, 2007 8:24 pm Post subject: downloading files is difficult |
 |
|
Joined: 21 Feb 2007
Posts: 43
Location: Nashville, TN
|
Links in the download section are not represented as path with filenames, so i can't use download managers to grab a slew of files.
Somehow you passed the file type and name through so when i save a file from the browser, it retains the filename, even though the browser is still calling it index.php. It would be excellent if you could pass that same information to the browser in the file list. |
|
| |
|
 |
Ben
|
| Posted: Tue Oct 23, 2007 1:06 am Post subject: |
|
|
|
| For security reasons the filenames are hash encoded and placed in a directory above the web root, so Copper is checking your permissions and sending the file rather than having it open for all to guess a URL and download your important files. |
|
| |
|
|
scollins
|
| Posted: Tue Oct 23, 2007 2:15 am Post subject: |
|
|
Joined: 21 Feb 2007
Posts: 43
Location: Nashville, TN
|
| can it pass the filename, not path, or at least the file extension? |
|
| |
|
|
Ben
|
| Posted: Tue Oct 23, 2007 2:19 am Post subject: |
|
|
|
You can check out a file, or right click and download it directly from the files list.
When you right click and save the file it should save as the filename, are you saying it saves as index.php?? Which browser are you using? |
|
| |
|
|
scollins
|
| Posted: Tue Oct 23, 2007 2:28 am Post subject: |
|
|
Joined: 21 Feb 2007
Posts: 43
Location: Nashville, TN
|
Yeah, when i mouseover or right-click a file in the Files view, the path is something like http://www.domain.com/index.php?module=files&fileid=189&action=filedown
The filename and extension shows as a link, but the actual link is just a php query. it is for this reason that i can't download with a download manager. Even if the path was faked, and the file extension was in the link, i could grab them.
This is with Firefox 2.0, IE6 and IE7. |
|
| |
|
|
Ben
|
| Posted: Tue Oct 23, 2007 2:41 am Post subject: |
|
|
|
In safari, I can right click and choose "Save Linked" and it downloads fine via Safari's download manager, in Firefox I can choose Right-click "Save Link as...." but I have to also manually type the file name.
I didn't test IE, but I seem to recall a similar "save linked" option. |
|
| |
|
|
scollins
|
| Posted: Tue Oct 23, 2007 5:08 pm Post subject: |
|
|
Joined: 21 Feb 2007
Posts: 43
Location: Nashville, TN
|
| i confirm your Fx test. Unfortunately this prevents using a download manager that searches for files to download. For example, a Firefox addon like DownThemAll or FlashGet searches for links to files by type, and in this case, the links are to php files, as far as the app is concerned. If the links could have file extensions, a download manager could regonize them and i could download them all in the background, whereas now i have to click each link individually and manually type in the name. With a long list of files, this takes a long long time. |
|
| |
|
|
Ben
|
| Posted: Wed Oct 24, 2007 1:33 am Post subject: |
|
|
|
To be honest at this stage it isn't a high priority to enable firefox download managers to do their thing, but if enough people request it we'll look at a solution.
If you need a bespoke solution we could remove the hash-encoding of file names, bring the copper_files folder under the web root, and revert to real file names. While this would enable anyone to download your files, it might add the efficiencies you need. |
|
| |
|
|
scollins
|
| Posted: Wed Oct 24, 2007 1:39 am Post subject: |
|
|
Joined: 21 Feb 2007
Posts: 43
Location: Nashville, TN
|
| Isn't there a way to fake a filetype by adding a faux extension to the hash-encoded filename? You're generating the links dynamically, right? |
|
| |
|
|
Ben
|
| Posted: Wed Oct 24, 2007 1:53 am Post subject: |
|
|
|
| No, even if we did you can't hit that directory in a browser, its above the web root. |
|
| |
|
|
scollins
|
| Posted: Wed Oct 24, 2007 2:03 am Post subject: |
|
|
Joined: 21 Feb 2007
Posts: 43
Location: Nashville, TN
|
i don't know anything about hash-encoded filenames, but from what i understand, the file exists at
| Code: |
| /home/files/folder/filename.ext |
And the link says:
| Code: |
| /index.php?module=files&fileid=181&action=filedown |
(where index.php is at /home/public_html/index.php)
Is there no way to make the link say:
even though the file doesn' exist there, in the same way that "/index.php?module=files&fileid=181&action=filedown" isn't a literal location of a file either? |
|
| |
|
|
Ben
|
| Posted: Wed Oct 24, 2007 2:08 am Post subject: |
|
|
|
| Creating a symlink or similar represents the same security issues as having the files sit under the web root, so no, not without compromising the security model. |
|
| |
|
|
Dennis Reichel
|
| Posted: Fri Nov 02, 2007 11:33 pm Post subject: |
|
|
Joined: 31 Oct 2007
Posts: 2
Location: West Palm Beach, FL, USA
|
| Ben wrote: |
| Creating a symlink or similar represents the same security issues as having the files sit under the web root, so no, not without compromising the security model. |
Using apache's mod_rewrite and the appropriate rule, you could map the query to a nice (non-query looking) url. This, and providing copper with an option to show links to the files in these nice representations if mod_rewrite is used would solve the problem, while leaving the security model intact.
-- Dennis |
|
| |
|
|
nboot
|
| Posted: Tue Nov 20, 2007 10:32 pm Post subject: Re: downloading files is difficult |
|
|
|
| scollins wrote: |
Links in the download section are not represented as path with filenames, so i can't use download managers to grab a slew of files.
Somehow you passed the file type and name through so when i save a file from the browser, it retains the filename, even though the browser is still calling it index.php. It would be excellent if you could pass that same information to the browser in the file list. |
I'm having the same problem with Firefox, but I'm not using any download managers. Any attempt to download a file from a project's file listing results in an empty file being sent with the name of "index.php"
The filename *should* be as it is in the file listing, as the Content-Disposition header is being sent with the appropriate filename. Still seems to want to download as index.php though.
Has anyone had any luck with this at all? |
|
| |
|
|
Ben
|
| Posted: Wed Nov 21, 2007 1:24 am Post subject: |
|
|
|
We have no other registered complaints, and the online demos and all hosted accounts are working as far as we know (i.e. if they weren't we'd soon know about it!) 
Which version are you running and can you get in touch? |
|
| |
|
|
