cordlandwehr/typo3-tx_meetings — Issue #9: document access
Author: rittmeier
Created: 2012-03-05 00:24:57+00:00
State: open

The meeting documents and protocols with different access levels should not be published using the same folder.

The basic folder with all uploaded documents should not be accessible directly using http. All documents with access level "public" should be made public using symlinks to a "public" folder. For all documents with limited access a folder for the specific session of the current frontend user should be created which then contains symlinks to all limited access documents which are accessible by the current frontend user. It should be sufficient to generate those symlinks while the extension sends html to the webbrowser containing hyperlinks to those files.

Those session folders should be removed approx. x hours (x=24 or 48) after creation. In addition a htaccess file should be placed inside limiting the access to this session folder to the ip of the frontend user.

The use of session folders helps, that the filename itself stays untouched when accessing/downloading.

Too fight folder fragmentation it might be useful to group session folders by their first letter in a separate subfolder.