Controlling access to attachments

[ncg]

We have a paid website and a free forum. Currently forum members and forum guests have permission to see and download all attachments. We encourage members to post some of our website content in the forums but do not want to be giving away paid content for free so we want only website members to be able to access the attachments themselves.

So we'd like that forum members and forum guests are allowed to see the thumbnails but only Website members have access to the actual attachments. I know that we could do this with IMG & URL links rather than the attachment function but it presents a problem.

1. Posters will have to source or create their own thumbnails. They could source thumbnails from the members area of the site but they are currently stored in a DB and are referred to in the following format, which doesn't display as a thumbnail in the forums - http://domain.com/media.php?id=134519

Short of integrating the seperate website and forum accounts into single accounts is it possible?

I thought that putting membership restrictions on the attachment directory would be the easiest way to go but this will also restrict access to the thumbs wont it? We would like the thumbnails to be visible to all.

Is there any quick and easy way to do this? Can we put the membership restriction on that directory but exclude any of the .thumb files? Will that work?

[calorie]

Try the following...

Product: vBulletin
Hook Location: attachment_start
Title: Closed Attachments
Plugin PHP Code: code is below
Plugin is Active: Yes

// start Closed Attachments code

/*************************************************************
                       SET THESE VALUES
*************************************************************/
$forums_closed_to_guest_attach_views = array(1,2,3,4,5);
$user_ids_whose_attaches_are_closed = array(1);
$user_groups_allowed_to_see_attaches = array(5,6,7);
/************************************************************/

if (!$attachmentinfo_check = $db->query_first("
	SELECT attachment.userid, thread.forumid
	FROM " . TABLE_PREFIX . "attachment AS attachment
	LEFT JOIN " . TABLE_PREFIX . "attachmenttype AS attachmenttype ON (attachmenttype.extension = attachment.extension)
	LEFT JOIN " . TABLE_PREFIX . "post AS post ON (post.postid = attachment.postid)
	LEFT JOIN " . TABLE_PREFIX . "thread AS thread ON (post.threadid = thread.threadid)
	WHERE " . ($vbulletin->GPC['postid'] ? "attachment.postid = " . $vbulletin->GPC['postid'] : "attachmentid = " . $vbulletin->GPC['attachmentid']) . "
"))
{
	eval(standard_error(fetch_error('invalidid', $vbphrase['attachment'], $vbulletin->options['contactuslink'])));
}

$user_groups_allowed_for_attachments = array();
if ($vbulletin->userinfo['userid'] > 0 && $vbulletin->userinfo['membergroupids'])
{
	$user_groups_allowed_for_attachments = explode(",",str_replace(" ","",$vbulletin->userinfo['membergroupids']));
}
$user_groups_allowed_results = array_intersect($user_groups_allowed_to_see_attaches, $user_groups_allowed_for_attachments);

if (
	in_array($attachmentinfo_check['forumid'], $forums_closed_to_guest_attach_views)
		&&
	in_array($attachmentinfo_check['userid'], $user_ids_whose_attaches_are_closed)
		&&
	!in_array($vbulletin->userinfo['usergroupid'], $user_groups_allowed_to_see_attaches)
		&&
	empty($user_groups_allowed_results)
)
{
	print_no_permission();
}

// end Closed Attachments code

[Marco van Herwaarden]

Or just make your website users member of a secondary usergroup, and only allow that usergroup to download attachemnts.

[ncg]

Hi Calorie,

Im no php expert. Could you let me know how to apply that (which file etc) and what it does?

Originally Posted by calorie

Try the following...

Product: vBulletin
Hook Location: attachment_start
Title: Closed Attachments
Plugin PHP Code: code is below
Plugin is Active: Yes

[calorie]

ACP -> Plugin System -> Plugin Manager -> Add New Plugin -> fill in fields

It allows you to set who can see what and where according to the following:

$forums_closed_to_guest_attach_views = array(1,2,3,4,5);
$user_ids_whose_attaches_are_closed = array(1);
$user_groups_allowed_to_see_attaches = array(5,6,7);

[kartik786]

Even I have a similar problem.

I m running vb 3.5.3

I wish to have promotions such that registered users cannot download the attachments and the new usergroup can.

I tried it, but it just did not work. Registered users were able to download attachments.

On top, people in the second usergroup were not able to even view the forum and it gave them the " you do not have permission " error message.

Can anyone please explain this in detail ?

I want it such that only members having more than 10 posts can download the attachments.

PS : I already have a promotion running wherein only people with more than 100 posts can view a particular forum.

PPS : Is there a plugin / mod or something which can make it easier ? I downloaded the download attachment restriction plugin but it restricts only for 1 post.

[TCB]

Originally Posted by calorie

Try the following...

Product: vBulletin
Hook Location: attachment_start
Title: Closed Attachments
Plugin PHP Code: code is below
Plugin is Active: Yes

// start Closed Attachments code

/*************************************************************
                       SET THESE VALUES
*************************************************************/
$forums_closed_to_guest_attach_views = array(1,2,3,4,5);
$user_ids_whose_attaches_are_closed = array(1);
$user_groups_allowed_to_see_attaches = array(5,6,7);
/************************************************************/

if (!$attachmentinfo_check = $db->query_first("
	SELECT attachment.userid, thread.forumid
	FROM " . TABLE_PREFIX . "attachment AS attachment
	LEFT JOIN " . TABLE_PREFIX . "attachmenttype AS attachmenttype ON (attachmenttype.extension = attachment.extension)
	LEFT JOIN " . TABLE_PREFIX . "post AS post ON (post.postid = attachment.postid)
	LEFT JOIN " . TABLE_PREFIX . "thread AS thread ON (post.threadid = thread.threadid)
	WHERE " . ($vbulletin->GPC['postid'] ? "attachment.postid = " . $vbulletin->GPC['postid'] : "attachmentid = " . $vbulletin->GPC['attachmentid']) . "
"))
{
	eval(standard_error(fetch_error('invalidid', $vbphrase['attachment'], $vbulletin->options['contactuslink'])));
}

$user_groups_allowed_for_attachments = array();
if ($vbulletin->userinfo['userid'] > 0 && $vbulletin->userinfo['membergroupids'])
{
	$user_groups_allowed_for_attachments = explode(",",str_replace(" ","",$vbulletin->userinfo['membergroupids']));
}
$user_groups_allowed_results = array_intersect($user_groups_allowed_to_see_attaches, $user_groups_allowed_for_attachments);

if (
	in_array($attachmentinfo_check['forumid'], $forums_closed_to_guest_attach_views)
		&&
	in_array($attachmentinfo_check['userid'], $user_ids_whose_attaches_are_closed)
		&&
	!in_array($vbulletin->userinfo['usergroupid'], $user_groups_allowed_to_see_attaches)
		&&
	empty($user_groups_allowed_results)
)
{
	print_no_permission();
}

// end Closed Attachments code

Do you have something simular for 3.6? I just want to enable for all guests (and all other groups) to see the thumbnails. So no permissions for the thumbnails.

[TCB]

** bump **