Unable to get original file name when downloading

[rodophebricaud]

Hi Aurelien,

Thx for you work :)
By the way, could you set the token's parameters in query string ? I have to set Content-Disposition: attachment; filename="downloaded.pdf" in varnish to be able to download the file with the correct name :)

Thx !

[footplus]

Hello,

I did not try it, but I think this is doable.

The recommended way of using this module is to write something along the lines of:

set req.url = secdown.check_url(req.url, "h4ckme", "/expired.html", "/error.html")

You need to conform to the "....../<md5_hash>/<expiration_timestamp>" model. But since req.url contains the query string at the beginning you may just calculate it with a trailing ?, to start a query string. For example:

• Request an URL like /..../my/test/file.extension?/d8e8fca2dc0f896fd7cb4cb0031ba249/12345678, with the md5 calculated on "/.../my/test/file.extension?".
• check the URL via secdown, and assign the result to req.url.
• delete (or not) the eventual trailing ? from the URL, to clean it up (or cache the file with the trailing ?, since you'll always get it).

Another option would be to regsub the ? out of the equation before calling check_url.

Another way would be to patch the vmod, adding a way to set the regular expression to something user-defined, but then it would require other modifications in the vmod... I'm also not clear about the correct way to implement this.

Best regards,
Aurelien

[ghost]

Another option would be to change "hash" and "path" and rewrite them in Varnish.

For example:

Original URL: http://www.example.com/download/00/n/a/narutoPROJECT_-_RockLeeSD_007.avi/8e1fe02a67d1836f10525d076aaa959d/4fbaf6e4

Change the URL to: http://www.example.com/download/8e1fe02a67d1836f10525d076aaa959d/4fbaf6e4/00/n/a/narutoPROJECT_-_RockLeeSD_007.avi

And rewrite it in Varnish:
set req.url = regsub(req.url,"/download/(.+)/(00/.+)","/\2/\1");
set req.url = secdown.check_url(req.url, "sharexprotected", "/expired.html", "/error.html");

Well, it worked for me.