Advertisement
Anime4000

PMPro protect (lock) download non wordpress file

Jan 30th, 2015
333
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 3.15 KB | None | 0 0
  1. <?php
  2. /*
  3. Plugin Name: PMPro Customizations
  4. Plugin URI: http://www.paidmembershipspro.com/wp/pmpro-customizations/
  5. Description: Customizations for Paid Memberships Pro
  6. Version: 0.1
  7. Author: You
  8. Author URI: https://facebook.com/You
  9. */
  10. // NOTE: Copy this code and paste it at: wp-content/plugins/pmpro-customizations/pmpro-customizations.php
  11. //       You can add more modification here
  12. /* PMPro Protect Download */
  13. function my_pmpro_getfile()
  14. {
  15.     if(isset($_REQUEST['pmpro_getfile']))
  16.     {
  17.         global $wpdb;
  18.  
  19.         //prevent loops when redirecting to .php files
  20.         if(!empty($_REQUEST['noloop']))
  21.         {
  22.             status_header( 500 );
  23.             die("This file cannot be loaded through the get file script.");
  24.         }
  25.  
  26.         $uri = $_REQUEST['pmpro_getfile'];
  27.         if($uri[0] == "/")
  28.             $uri = substr($uri, 1, strlen($uri) - 1);
  29.  
  30.         /*
  31.         Remove ../-like strings from the URI.
  32.         Actually removes any combination of two or more ., /, and \.
  33.         This will prevent traversal attacks and loading hidden files.
  34.         */
  35.         $uri = preg_replace("/[\.\/\\\\]{2,}/", "", $uri);
  36.  
  37.         //edit to point at your protected directory
  38.         $new_uri = "downloads/" . $uri;
  39.    
  40.         $filename = ABSPATH . $new_uri;
  41.         $pathParts = pathinfo($filename);              
  42.  
  43.         //remove params from the end
  44.         if(strpos($filename, "?") !== false)
  45.         {
  46.             $parts = explode("?", $filename);
  47.             $filename = $parts[0];
  48.         }
  49.  
  50.         //add index.html if this is a directory
  51.         if(is_dir($filename))
  52.             $filename .= "index.html";
  53.  
  54.         //only checking if the file is pulled from outside the admin
  55.         if(!is_admin())
  56.         {          
  57.             //non-members don't have access (checks for level 2 or 3)
  58.             if(!pmpro_hasMembershipLevel())
  59.             {
  60.                 //nope             
  61.                 //header('HTTP/1.1 503 Service Unavailable', true, 503);
  62.                 //echo "HTTP/1.1 503 Service Unavailable";
  63.                 wp_redirect(wp_login_url());
  64.                 exit;
  65.             }          
  66.         }
  67.  
  68.         //if file is not found, die
  69.         if(!file_exists($filename))
  70.         {
  71.             status_header( 404 );
  72.                 nocache_headers();        
  73.                 die("File not found.");
  74.         }
  75.  
  76.         //if blacklistsed file type, redirect to it instead
  77.         $basename = basename($filename);
  78.         $parts = explode('.', $basename);
  79.         $ext = strtolower($parts[count($parts)-1]);
  80.  
  81.         //build blacklist and allow for filtering
  82.         $blacklist = array("inc", "php", "php3", "php4", "php5", "phps", "phtml");
  83.         $blacklist = apply_filters("pmpro_getfile_extension_blacklist", $blacklist);
  84.  
  85.         //check
  86.         if(in_array($ext, $blacklist))
  87.         {      
  88.             //add a noloop param to avoid infinite loops
  89.             $uri = add_query_arg("noloop", 1, $uri);
  90.  
  91.             //guess scheme and add host back to uri
  92.             if(is_ssl())
  93.                 $uri = "https://" . $_SERVER['HTTP_HOST'] . "/" . $uri;
  94.             else
  95.                 $uri = "http://" . $_SERVER['HTTP_HOST'] . "/" . $uri;
  96.  
  97.             wp_redirect($uri);
  98.             exit;
  99.         }
  100.  
  101.         require_once(dirname(__FILE__) . '/../paid-memberships-pro/classes/class.mimetype.php');
  102.  
  103.         //otherwise show it
  104.         $mimetype = new pmpro_mimetype();                      
  105.         header("Content-type: " . $mimetype->getType($filename));
  106.         header("Content-Disposition: attachment; filename=" . basename($filename) . ";"); /*make sure download file name not random*/
  107.         readfile($filename);
  108.         exit;
  109.     }
  110. }
  111. add_action("init", "my_pmpro_getfile");
  112. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement