At 11:50 AM 8/28/2001 -0400, you wrote:
>At 11:30 -0400 2001.08.28, shane wrote:
> >Has anyone tried to come up with a system and/or code to let people download
> >files from a slash-site, but render the source of the file unreadable?
>
>I am planning this for an image gallery plugin (is that what you want it
>for?).
Yes, and no :)
I need to come up with something over the next week because
I offered to mirrors someone's files for them. But I need to keep
a cautious eye on how much/what's downloaded so that it doesn't
eat up my own bandwidth.
The yes part was that I definitely wanted to put this sort of
functionality into the galleria plugin eventually, as an option.
> That is, if I do my own instead of using yours.
If you want to combo the effort, email me.
>Basically, have perl code can read in the file, and then send it to the
>browser directly (setting the proper HTTP header, esp. MIME type). The URL
>to this could be, for example:
>
> http://site/plugin.pl?op=download&file=foo.jpg
>
>However, you might want to mix it up a lot more. For example:
>
> http://site/plugin.pl?op=download&file=foo.jpg&key=876FA3BD12
>
>Key could be a few things. It could be a random string inserted into the
>DB for that file's record (see the routine used to create new passwords;
>you could just use that). Or for more protection, it could be that random
>string crypt'ed with the user's password as salt:
>
> my $key = crypt($record->{key}, $user->{passwd});
>
>Then $key is unique for each user and each file, so users cannot give the
>URL to each other (well, they could, but chances are it won't work).
>Actually, now that I think of it, if you just get two random characters as
>the key, you can use that as the salt, and then crypt the user's password
>with that salt:
>
> my $key = crypt($user->{passwd}, $record->{key});
>
>Then it should be even more unique per user.
that'll work. thanks for the advice guys. I've got my work cut out for me
now :)
Shane
|