SIGN UP

Protected files not accessible to everyone

By: Vicky Tosh-Morelli | Asked: 09/12/2022
Forums › Category: General questions › Protected files not accessible to everyone
0 Vote Up Vote Down
Vicky Tosh-Morelli asked 2 years ago
I have the Protect all files uploaded to the form checked and I have Role required to access file set to Everyone. (https://ce.udel.edu/people/faculty-profile/?id=10) The Full CV link at the bottom should allow anyone visiting the page to access the file but instead I get the Oops! This file is protected. message. I also have this same form/view and settings on another site and it works fine. Any one can access the CV file from the protected link. https://www.cis.udel.edu/people/faculty-profile/?id=263
The files are accessible if I turn off the protection but I'd rather keep it on since we were victims of some of the form spamming that happened at the beginning of this year. Rather not have spammers be able to see the file paths to the uploads folder. Has anyone else run into this? 


Form Link: https://ce.udel.edu/people/faculty-profile/?id=10
Error Message: Oops! That file is protected
WP Version: 6.0.2
Formidable Version: 5.4.5
Vicky Tosh-Morelli replied 2 years ago

I'm going to turn file protection off since I don't want the site to continue to appear broken but this link will demonstrate the same problem: https://test-ceeg.pantheonsite.io/people/faculty-profile/?id=690

2 Answers
0 Vote Up Vote Down
Best Answer
Vicky Tosh-Morelli answered 2 years ago
The fix appears to be to NOT use target="_blank" on protected file links.  The difference I finally noticed between the two sites is that the one giving the oops error had the file opening in a new tab while the one that was working did not. Removing that seems to have fixed the issue. If the target=blank is the issue it kind of makes sense since the idea of the protected path is to prevent people from just using the file url on it's own to access the file from say another spammy site. I guess a new blank page triggers the same action.  
Bobby Clapp replied 2 years ago

Sounds reasonable. Glad you were able to work it out.

1 Vote Up Vote Down
Bobby Clapp answered 2 years ago
I expect you will want to see if your file server permissions allow anyone to see the contents of the directory your files are being saved.
Vicky Tosh-Morelli replied 2 years ago

I did double check that and since the files are accessible with protection turned off I was pretty sure that wasn't the issue. I should say, this is a new issue and it was working fine up until late last week as far as I know.

Vicky Tosh-Morelli replied 2 years ago

That's for sharing a file after a form has been submitted: "Use Formidable Forms Pro to protect your gated content file downloads and offer a download file on submit. " Not what I'm doing.

Bobby Clapp replied 2 years ago

I misunderstood then. With what I'm seeing it seems like you are doing the second part.

https://formidableforms.com/knowledgebase/offer-protected-file-form-submission/#kb-step-2-create-a-view-to-display-the-protected-files

Is that not the case?

Vicky Tosh-Morelli replied 2 years ago

<p>This is the code in the view:</p><p> </p><pre>Start your code here[if 135]<a href="[135]" target="_blank" rel="noopener noreferrer"><strong>View Full CV</strong></a>[/if 135]</pre>

Vicky Tosh-Morelli replied 2 years ago

Minus all the extra html the comment form added....

Bobby Clapp replied 2 years ago

I'm going to ask some stupid questions so apologies. I'm not logged in. I should not see the protected output, correct? Are you getting the same thing while logged in?

Vicky Tosh-Morelli replied 2 years ago

The permissions are set so Everybody CAN see the file.

The file path is changed from what you would normally see

https://ce.udel.edu/wp-content/uploads/formidable/10/Davidson-CV-7.21.pdf

to a protected path like

https://test-ceeg.pantheonsite.io/frm_file/aWQ6NDE3NzV8ZmlsZW5hbWU6RGF2aWRzb24tQ1YtNy4yMS5wZGY=

When I'm logged in I can view as expected but in an incognito window I get the oops message.

It's still baffling that it works fine on the other site. Even more baffling - if you right click on the image and open in a new tab the image is accessible with the protected path.

So even if it something particular to PDFs why is it still working on the other site but not this one (other than they are running slightly different versions of FF?)

Vicky Tosh-Morelli replied 2 years ago

Okay - I found a difference between the two views that I think is causing the problem. On the CE site I have the link set to target="_blank" and on the CIS site there is one.

I just changed the view on the test-ceeg site to remove the target=blank and the rel=noopener noreferrer and I think it works now.

Can you try this URL and see if you can view the CV: https://test-ceeg.pantheonsite.io/people/faculty-profile/?id=690

Vicky Tosh-Morelli replied 2 years ago

If the target=blank is the issue it kind of makes sense since the idea of the protected path is to prevent people from just using the file url on it's own to access the file from say another spammy site. I guess a new blank page triggers the same action.

Bobby Clapp replied 2 years ago

I still cannot.

Bobby Clapp replied 2 years ago

Correction, I CAN after clearing the page cache.

Vicky Tosh-Morelli replied 2 years ago

Woot! Thanks for the help - your persistence made me double check everything again. I'll add my own solution.

Making the Best WordPress Plugin even better - Together

Take on bigger projects with confidence knowing you have access to an entire community of Formidable Experts and Professionals who have your back when the going gets tough. You got this!
Join the community
crossarrow-right