MusicStore mp3 sample - access to files

Hi,

If you want to keep the htaccess so that the files of the upload/safe folder cannot be accessed directly, then you need to move your sample files outside of the upload/safe folder.
For example, move them in the upload folder directly, and then change the line:

$songPath = '/media/com_hikashop/upload/safe/'.$this->element->files[0]->file_path;

$songPath = '/media/com_hikashop/upload/'.$this->element->files[0]->file_path;

Hi,

1. It is indeed important that you don't remove the htaccess from the upload/safe/ folder so that the files you sell cannot be accessed directly. And that's why I was proposing that you don't remove it, but instead that you move the sample files outside of that folder. I suppose that it's not a problem that people could potentially download the sample files.

2. To be able to allow the download of files in the upload/safe folder only for people who purchased the files, what we do is we have a PHP script which checks that the current user has the right to download the file. And we change the link to the file so that it goes to this script with the id of the file and the id of the order in the URL so that the PHP script can do its checks. Then, once it's validated, it reads the file in the memory of the server and sends the data itself. That way, the PHP scripts circumvents the htaccess as it doesn't go through apache to read the file but directly reads it on the filesystem of the server.

3. You could potentially do something similar as what I explained in point 2. However here is a simpler approach:
- have all your sample files start or end with a specific text
- use the filesmatch system in your htaccess to deny access to the files not starting/ending with that specific text:
www.opentechguides.com/how-to/article/ap...le-dir-security.html
That way, you wouldn't have to change your custom code and move the sample files. You could just adapt the htaccess.
Note however that the htaccess will be overwritten when you update HikaShop unless you change its permissions so that it can't be overwritten. So if you can't change its permissions, I would recommend to stick with the solution I proposed in my previous message (and point 1 ).

Hi,

The download controller requires a file entry in the hikashop_file table and based on how the file is configured, it requires an order id of an order with the corresponding product purchased.
So supposing that you add the sample fiel as a "free download" file in the product backend edition interface, you'll get the URL you need to use on the frontend product page.
Supposing that you're editing a view file of the product page via the Display>Views menu, in the variable $this->element->files you have an array of all the free download files of the product.
So you can output the links like that:

foreach($this->element->files as $file) {
 echo $file->download_link;
}

hikashop_completeLink('product&task=download&file_id=' . $file->file_id.$url_itemid);