Skip to content

Instantly share code, notes, and snippets.

@neverything

neverything/.htaccess

Forked from trongcong/.htaccess
Created January 22, 2019 15:35
Show Gist options
  • Save neverything/b7aff04d2d3d9ede450c8511f55f9927 to your computer and use it in GitHub Desktop.
Save neverything/b7aff04d2d3d9ede450c8511f55f9927 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @trongcong trongcong revised this gist Sep 19, 2017. 1 changed file with 4 additions and 4 deletions.
    8 changes: 4 additions & 4 deletions dl-file.php
    View file
    Original file line number Diff line number Diff line change
    @@ -19,7 +19,7 @@
    * @registry SPDX
    */

    class checkLogin {
    class yourFun {
    function _read_file( $mimetype, $file ) {
    header( 'Content-Type: ' . $mimetype ); // always send this
    if ( false === strpos( $_SERVER['SERVER_SOFTWARE'], 'Microsoft-IIS' ) ) {
    @@ -52,7 +52,7 @@ function _read_file( $mimetype, $file ) {
    }
    }

    $check = new checkLogin();
    $fun = new yourFun();
    require_once( 'wp-load.php' );

    list( $basedir ) = array_values( array_intersect_key( wp_upload_dir(), array( 'basedir' => 1 ) ) ) + array( null );
    @@ -76,9 +76,9 @@ function _read_file( $mimetype, $file ) {
    //die();

    if ( is_user_logged_in() ) {
    $check->_read_file( $mimetype, $file );
    $fun->_read_file( $mimetype, $file );
    } elseif ( ! is_user_logged_in() && is_array( getimagesize( $file ) ) ) {
    $check->_read_file( $mimetype, $file );
    $fun->_read_file( $mimetype, $file );
    } elseif ( ! is_user_logged_in() && ! is_array( getimagesize( $file ) ) ) {
    auth_redirect();
    }
  2. @trongcong trongcong revised this gist Sep 19, 2017. No changes.
  3. @trongcong trongcong revised this gist Sep 19, 2017. No changes.
  4. @trongcong trongcong created this gist Sep 19, 2017.
    5 changes: 5 additions & 0 deletions .htaccess
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,5 @@


    RewriteCond %{REQUEST_FILENAME} -s
    RewriteRule ^wp-content/uploads/(.*)$ dl-file.php?file=$1 [QSA,L]

    84 changes: 84 additions & 0 deletions dl-file.php
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,84 @@
    <?php
    /*
    * Protect uploaded files with login.
    *
    * dl-file.php
    * Block access to all files except images.
    *
    * Add file dl-file.php to root Wordpress
    * Add two line on .htaccess:
    * RewriteCond %{REQUEST_FILENAME} -s
    * RewriteRule ^wp-content/uploads/(.*)$ dl-file.php?file=$1 [QSA,L]
    *
    * @link http://wordpress.stackexchange.com/questions/37144/protect-wordpress-uploads-if-user-is-not-logged-in
    * @old file https://gist.github.com/hakre/1552239
    *
    * @author hakre <http://hakre.wordpress.com/>
    * @edit trongcong <https://2dev4u.com/>
    * @license GPL-3.0+
    * @registry SPDX
    */

    class checkLogin {
    function _read_file( $mimetype, $file ) {
    header( 'Content-Type: ' . $mimetype ); // always send this
    if ( false === strpos( $_SERVER['SERVER_SOFTWARE'], 'Microsoft-IIS' ) ) {
    header( 'Content-Length: ' . filesize( $file ) );
    }
    $last_modified = gmdate( 'D, d M Y H:i:s', filemtime( $file ) );
    $etag = '"' . md5( $last_modified ) . '"';
    header( "Last-Modified: $last_modified GMT" );
    header( 'ETag: ' . $etag );
    header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', time() + 100000000 ) . ' GMT' );
    // Support for Conditional GET
    $client_etag = isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) ? stripslashes( $_SERVER['HTTP_IF_NONE_MATCH'] ) : false;
    if ( ! isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) ) {
    $_SERVER['HTTP_IF_MODIFIED_SINCE'] = false;
    }
    $client_last_modified = trim( $_SERVER['HTTP_IF_MODIFIED_SINCE'] );
    // If string is empty, return 0. If not, attempt to parse into a timestamp
    $client_modified_timestamp = $client_last_modified ? strtotime( $client_last_modified ) : 0;
    // Make a timestamp for our most recent modification...
    $modified_timestamp = strtotime( $last_modified );
    if ( ( $client_last_modified && $client_etag )
    ? ( ( $client_modified_timestamp >= $modified_timestamp ) && ( $client_etag == $etag ) )
    : ( ( $client_modified_timestamp >= $modified_timestamp ) || ( $client_etag == $etag ) )
    ) {
    status_header( 304 );
    exit;
    }
    // If we made it this far, just serve the file
    readfile( $file );
    }
    }

    $check = new checkLogin();
    require_once( 'wp-load.php' );

    list( $basedir ) = array_values( array_intersect_key( wp_upload_dir(), array( 'basedir' => 1 ) ) ) + array( null );
    $file = rtrim( $basedir, '/' ) . '/' . str_replace( '..', '', isset( $_GET['file'] ) ? $_GET['file'] : '' );
    if ( ! $basedir || ! is_file( $file ) ) {
    status_header( 404 );
    die( '404 &#8212; File not found.' );
    }

    $mime = wp_check_filetype( $file );
    if ( false === $mime['type'] && function_exists( 'mime_content_type' ) ) {
    $mime['type'] = mime_content_type( $file );
    }
    if ( $mime['type'] ) {
    $mimetype = $mime['type'];
    } else {
    $mimetype = 'image/' . substr( $file, strrpos( $file, '.' ) + 1 );
    }

    //var_dump(is_array(getimagesize($file)));
    //die();

    if ( is_user_logged_in() ) {
    $check->_read_file( $mimetype, $file );
    } elseif ( ! is_user_logged_in() && is_array( getimagesize( $file ) ) ) {
    $check->_read_file( $mimetype, $file );
    } elseif ( ! is_user_logged_in() && ! is_array( getimagesize( $file ) ) ) {
    auth_redirect();
    }