[ic] Downloadable softgoods - my solution

[Russell Mann]

> >I don't want to allow open Indexes.  This would compromise
> security on the
> >products.  Do you have open indexes for this solution?
> >
> >
> I do a PERL readdir() to grab the list of files in the directory then
> pump them out as links on a generated HTML page. Either way (yours,
> where the list is compiled or mine, where the list is generated) they
> still know the filename. The important thing is that they can't do
> anything with that information.
>
> Though, even if the user knew the exact path to the document (which the
> user doesn't, in either case), how would he get access to it without
> logging in and thus validating himself? e.g. if you knew the file was
> physically located in
> /home/sites/mysite.com/digitaldocs/sku123/my_secure_document.doc, how
> would you get to it illegitimately?
>

Ok, I think I see what you're saying.  The reason I list the files in the
product DB is so I can display the links in beautified HTML with further
instructions, authenticated for login etc rather than just point the user to
the download server.

With my solution, the files aren't actually located in the web directory, so
you can't browse using the SKU if you wanted to.  The actual files are
stored in /download_dir/<SKU>/* and the symlink from /web_dir/<secret key>
to the <SKU> directory allows downloading.

To guess that you'd have to brute force all possible 7 letter combinations
(I just use 7 arbitrarily, you could go more if you want), then guess the
actual file names, because you can't browse the directory.

-Russell