limit downloads

[Jezternz]

Ok I have a registration/permissions system setup, and I want to limit different user groups to only allow for an amount of downloads. (and non-logged in users to not have the ability to download anything at all). The files are stored in a public directory on my web server. I have a decent php knowledge and have worked with mysql a fair bit, so database stuff is no probs.
Any ideas on how I could limit user access to files?

Thanks, Josh

[Markus]

I haven't done much (any) work in this area so, my ideas may not be the best. I apologise in advance.

You could log, in the database, the time their last download was and check it against the current time to see if x amount of time has passed. If so, allow the download, else, don't.

Cheers.

[Atli]

If the files are in a public directory you won't have any control over it.

You would have to either put it outside the web-root, where it can't be reached via a URL, or into a database, where you would have to use a script to fetch it.

Either way you could simply log each download and check that total amount. If the user is allowed to download it, just set the appropriate Content-Type header and echo the contents of the file from wherever it is actually stored.

[Jezternz]

yeh, I will be logging the users activity / download count ect, thats not a problem.
So say I had a folder outside the root directory say "downloads" how would I go about fetching the files for download (I realize it would be in something like download.php?f= bytes.exe) but how do I actually bring up the download?
Also will this apply for uploads as well? can i allow some restricted users to upload to the dir.

Thanks, Josh

[pbmods]

Heya, Josh.

Use readfile() to send the file data to the browser (http://php.net/readfile).

[Jezternz]

awesome thanks guys. Last thing, when choosing target location for uploads, can i use the same principle, and choose a location not in the public domain?

Thanks heaps, Josh

[Jezternz]

Just wanted to leave a note for anyone the future who has a similar problem.
You may use what PhMods said, by uploading files to a place not in public_html, so in a private directory, then using readfile to read them.
Also a good mysql query that allows you to check how many logged downloads a user has downloaded (which i used) is:

SELECT * FROM records WHERE userid = '".mysql_real_escape_string($userid)."' AND DATE_SUB(CURDATE(),INTERVAL 1 DAY) <= date_downloaded

This checks from a download-records table how many downloads have been done in the past "1 day" or 24 hours.

Thanks, Josh

[Markus]

awesome thanks guys. Last thing, when choosing target location for uploads, can i use the same principle, and choose a location not in the public domain?

Thanks heaps, Josh

Yes. To put it simply.