<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I belatedly realized I had basically repeated what Mark had already written when he wrote:<div><br></div><div>"This is correct - our ACL plugin generates .htaccess files for ACL'd media. However I should point out that this works in our case because we also bypass ms-files.php for serving uploads, and let Apache serve files directly. If your uploads are coming from ms-files.php (typical behavior), I don't think this approach would work without a new hook in ms-files.php to test access to the file being requested."</div><div><br></div><div>There's no hope for there ever being a hook into ms-files.php -- because SHORTINIT gets defined as true, it does a very basic initialization without defining any actions that can be hooked into. So I made a copy of the file that does do a full initialization and put it in my plugin folder. Then I added a field to the Edit Media and Upload Media forms that lets a user pick a predefined rule to use to restrict access to it. '/protected' is then inserted into the guid value for the file between the blog and file paths (not ideal, but I couldn't find a better way). I added</div><div><br></div><div><div>RewriteRule ^([_0-9a-zA-Z-]+/)?protected/(.+) wp-content/plugins/vcu_access_control/protected.php?file=$2 [L]</div></div><div><br></div><div>to the .htaccess file, and added a check to the modified ms-files.php copy (protected.php) for the relevant rule: if the test passes, the file gets delivered; if not, it returns a 401 (could be a 404). You can remove a rule from the uploaded file, and the '/protected' is removed, so it's handled like a normal file. There's a little more to it than that, but that's the gist.</div><div><br></div><div>I should add that the impetus for this on our end comes from a number of requests to create access restrictions by LDAP group, university department or affiliation, etc., without requiring that every member of such a group be added as a user to a specific site at any role level. When a file is restricted, a visitor is forced to log in through CAS, and I'm using phpCAS to check these attributes. I had initially set up a version that involved mod_auth_cas, mod_authnz_ldap and location matches, but this way, I don't have to touch the Apache conf files every time someone wants a restricted site -- the site administrator creates the rules, and access should be in sync with a user's latest university attributes. I kind of put the cart before the horse, as I'm just now getting back to the rule creation component of the plugin, but it's working so far with requiring a valid sign-in or any user on a list. </div><div><br></div><div><div>Jonathan Cox</div><div>VCU Webmaster</div><div>Technology Services</div><div>(804) 827-0067</div></div><div><div><br></div><div><div>On Jun 1, 2012, at 11:16 AM, Shawn Miller wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Not sure if this is helpful - but we've been recommending that people use Sakai for files that need to be truly private (as a stopgap measure for now anyway). At Duke, we use a homegrown group management tool called Toolkits to add course rosters to WordPress
sites, so the users in a Sakai course are the same users in a WordPress site. They just end up having to login via Shib when they want to access the Sakai-restricted content.
<div><br>
<div apple-content-edited="true">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
***********************<br>
Shawn J. Miller<br>
Academic Technology Consultant<br>
Center for Instructional Technology<br>
<br>
<a href="http://cit.duke.edu/about/staff/miller/">http://cit.duke.edu/about/staff/miller/</a><br>
<a href="mailto:shawn.miller@duke.edu">shawn.miller@duke.edu</a><br>
<a href="http://twitter.com/shawnj55">http://twitter.com/shawnj55</a> or @shawnj55<br>
<br>
</div>
</div>
<br>
</div>
</div>
_______________________________________________<br>wp-edu mailing list<br><a href="mailto:wp-edu@lists.automattic.com">wp-edu@lists.automattic.com</a><br><a href="http://lists.automattic.com/mailman/listinfo/wp-edu">http://lists.automattic.com/mailman/listinfo/wp-edu</a><br></blockquote></div><br></div></body></html>