protect page and directory content

[josefstr]

I have a page with login needed to access, is there a way to make the files in the directory also protected?
Let's have the following structure:
02.private/
├── default.md
└── protected.file.txt

I want to include the 'protected.file.txt' in default.md, but 'protected.file.txt' shouldn't be accesible for non-logged in users.

[flaviocopes]

Added as a "Protect a login-protected page media" option

[plavet]

I just tried this. the page is protected and there is a login form. once logged in
you can see protected media, mp3. picture, txt file etc. However, if you copy links to those
media files, you can access them directly, logged in or not you can access them.
How does "Protect a login-protected page media" works? I suppose tweaking .htaccess
to block this kind of linking might work. To sum up, from the original question

I want to include the 'protected.file.txt' in default.md, but 'protected.file.txt' shouldn't be accesible for non-logged in users.

even with "Protect a login-protected page media" enabled, non-logged in users can access
page protected media with direct link.

[josefstr]

I couldn't find the option "Protect a login-protected page media", so I could test it, too. Could you point me to this option?

[plavet]

Yes you just go to plugins page, it's Login v2.0.0, just click on the name and you are then on the plugins setup page, scroll to bottom and you can enable it there. I dont know maybe am doing something wrong :)

[josefstr]

thanks for pointing me to this option, just enabling the option doesn't protect any page content. Perhaps we are missing some other option we have to set.

[flaviocopes]

It's "Protect a login-protected page media" in the plugin configuration.

The page media is protected when accessed through the page route, as in site.com/yourpage/yourmedia.mp3

[plavet]

Yes that is what I am talking about, to recreate:
create a page, name it for example Download, in Frontmatter add

title: Download
access:
    site.login: true

In plugin settings enable "Protect a login-protected page media",
now go back to that page, "Download" for example, and add some media,
mp3, txt, jpg, then save, open the page, it will ask you to login. After login
you can access the page and see those media files, now copy the link adress
of either media file, for example site.com/yourpage/yourmedia.mp3,
then log out, paste that link in adress bar and it will give you access to that file,
or you don't have to log out just open another browser and paste that direct
link to the file and you can access it, logged in or not. The files are in correct place

02.download
├── default.md
└── protected.file.txt
└── protected.mp3
└── protected.jpg

So what am asking is, is that normal behavior of the Login plugin with
"Protect a login-protected page media" enabled? or am I doing something wrong?

[josefstr]

This issue is marked as closed, but as there is no comment if this issue is solved or not I'd like to know what's the current status on it. Thanks.

[rhukster]

See Flavio's comment: #45 (comment)

[josefstr]

and the behaviour of " plavet commented on 1 Aug " couldn't be reproduced on your side?

[jackbrycesmith]

Just had the same issue, fixed it by defining a route e.g. route: /login in login.yaml

[Dean-kasail]

i am able to access files with a direct link e.g /user/pages/09.folder/02.folder/_modular/somefile.pdf