Uploading a file and only letting certain users download it (LARAVEL) - php

Question

So I need users to upload files. These files can then be bought by customers (who are not users). Once the payment has been processed by stripe, the buyer should receive an email with a link to download the file.What I need is a download link for these files, that is only available to the user who has uploaded the file, and the customers who have bought the file.
Here is my controller for processing a form filled by a user to upload a file. NonUser is the details for the file from a previous form.
$note = new Note;
$note->title = $nonUser->title;
$note->description = $nonUser->description;
$note->mark = $nonUser->mark;
$note->page_count = $nonUser->page_count;
$note->subject_id = $nonUser->subject_id;
$note->year = $nonUser->year;
$note->modules = $nonUser->modules;
$note->price = $nonUser->modules*25;
$note->user_id = $user->id;
$note->exam_id=$user->exam_id;
$note->save();
Storage::put(
'notes/' . $note->id . '.pdf',
file_get_contents($request->file('notes')->getRealPath())
);
My stripe processing.
public function charge()
{
$nid = Session::get('nid');
$note = Note::where('id','=',$nid)->first();
$price = $note->price;
\Stripe\Stripe::setApiKey("sk_test_key");
$token = $_POST['stripeToken'];
try {
$charge = \Stripe\Charge::create(array(
"amount" => $price*100, // amount in cents, again
"currency" => "aud",
"source" => $token,
"description" => "Example charge"
));
} catch(\Stripe\Error\Card $e) {
flashWarning('An error occured');
return back();
}
flash('payment succesful! Check your email for a download link!');
return back();
}

Answer 1

I would use the following steps to service buyers:
Once payment is successful, store in the DB the orderID, fileID (should match the primary key of all files, stored in a different table) a random hash as download_ticket,a DateTime as ticket_expiration, and the # of times the ticket was used as download_count
Email the buyer a download link that points to a php script. The script should expect the download ticket. example:
example.com/download.php?ticket=m54hm4j390534gi2frew0094
In the script download.php, you would do the following:
Grab ticket from the query string: $ticket = $_GET['ticket']
Get the record in the DB: SELECT * from tbl WHERE ticket=m54hm4j390534gi2frew0094
If there is no match, error 404 not found with http_response_code(404) and abort.
If ticket_expiration has passed, delete the record, error 403 forbidden and abort.
If download_count has exceeded a limit, delete the record, error 429 too many requests and abort.
Use the fileID column to find the file that was purchased
If all checks workout, you can send the file to the user. do not redirect the user to the file's true location. Instead, do something like:
$path = '...'; // real path on disk
header('Content-Type: application/pdf');
header('Content-Length: ' . filesize($path));
$pipe = fopen($path, 'rb');
fpassthru($pipe); //sends file to user
fclose($pipe);
//TODO: increment `download_count` in the purchase record

Answer 2

You can do this by the following way
Step 1 : Generate the Link
After you do
Storage::put(
'notes/' . $note->id . '.pdf',
file_get_contents($request->file('notes')->getRealPath())
);
Generate the link with
$data['link'] = URL::to('/notes/'.$note->id.'pdf'); //Modify path according to your need
$message = 'Your Custom HTML';
Step 2 : Send the Email
Trigger mail to the User who uploads it
Mail::send(email.file, function ($message) {
$message->from('youremail#example.com', 'File Received');
$message->to(Auth::user()->email); // Email id of one who uploads it
});
Trigger mail who bought the file
$userlist = User::where('file_id' , $fileid)->get(); //modify the condition according to the tables you have
foreach($userlist as $users)
{
Mail::send(email.file, function ($message) {
$message->from('youremail#example.com', 'File Received');
$message->to($user['email']); // Looped Email id
});
}
Additional Step : (To make sure the file is secure)
Don't Point the file directly, you can do like this
Generate the link like this
yourapp.com/pdf/12/143
Where 12 is the user id and 143 is the pdf file's id
And under your controller you can check whether the user with id 12 is authorized to download the file with id 143, If so, then generate the pdf view or download it to the user.
Hope this helps you

Answer 3

When the payment is processed successfully store the PK of the file upload (from your database) in a new table (let's call it purchased downloads) along with a unique token that can be used to look up the file's PK in that table. This will be the token you'd send along with the email for them to download the file.
Create a new controller that accepts this token and looks up the unique token in the purchased downloads table then you can use something like an X-Sendfile header to have your webserver serve up the file to the client from your file system if the token verifies. You can also set an expiration time on this token if you'd like.