simple solution for restricting access to (some) uploads/downloads

I’m hereby answering my own question, because i found a solution, but I’m really interested in your opinions towards it. Or maybe you have a much better solution, if so, I really would like to here about it.

Research result

My research results were:
1. get the files outside of the document root, www folder;
2. disallow any direct access to the folder containing the files;
3. let a script handle the requests to the files;
The sources for those points are – at least mostly – included in my question.

Solution

1. I installed the plugin »wp-downloadmanager«
   • a folder called files will be created inside wp-content in the process;
2. I added a .htaccess file to the new files folder:
   • content of the .htaccess:
     Options All -Indexes
Order Deny,Allow
Deny from all
3. I changed one important option of the plugin:
   • the option I mean is download method;
   • I changed it to output file;
4. I added some files over the plugin interface:
   • there is a option called allowed to download;
   • which allows to restrict access based on user role/capability;
5. I did some testing:
   • no direct access to the files – not over the addressbar or wget;
   • public downloads can be reached via their permalinks – I choose »nice permalinks: yes« and »download url: file id« on the options panel – addressbar/wget is working too;
   • protected, restricted downloads are only accessible if logged in as user with the correct role/capabilities;

Concluding thoughts

I’m thinking the solution pretty much follows the research results. Apart from placing the files outside. But restricting access to/protecting the directory and let a script handle file requests is fullfilled. The restriction of access is handled by the .htaccess and the script in this case is the plugin wp-downloadmanger.

Supplementary notes

• it is absolutely necessary to change the download method to output file

• and of course it is a must that the .htaccess file is in place

• to check on the fact that the plugin takes over the role of the script take a look at wp-downloadmanger.php – about lines 207 to 227 (version 1.6.1); this is meant as complementary point to the linked information