如何保护未登录Yii2项目的任何人下载文件？

Question

Basically, i'm using a standard Yii2 set up. i have a login that allows a user to see links to files. the files are in a download folder.. but the page to see the links is only able to be seen if a user is "not guest." now, if anyone just copies the link to someone else, that other person will be able to download the file without being logged in. the files in question aren't being "paid for" BUT i am required to have people login before they are allowed to download them becuase of terms of service and other laws. can i dynamically create download links via php? at least check for "isGuest" and if isGuest = True then redirect to login page. how would i do that instead of just having a direct download link?

Answer 1

You can provide acces to an specific action to specific roles or users with AccessControl Class .

You can do something like this:

class DownloadController extends Controller
{
    public function behaviors()
    {
        return [
            'access' => [
                'class' => AccessControl::className(),
                'rules' => [
                    [
                        'allow' => false,
                        'actions' => ['download'],
                        'roles' => ['?'],
                    ],
                ],
            ],
        ];
    }
    // ...
}

'?' Role are the guest users.