FAL Secure Download 

Classification

fal_securedownload

Version

5.0

Language

en

Description

Secure download of assets.

Keywords

fal,download,secure download,filelist,filetree

Copyright

2014

Author

Frans Saris

Email

t3ext@beech.it

License

This document is published under the Open Content License available from http://www.opencontent.org/opl.shtml

Rendered

Thu, 30 Oct 2025 08:35:47 +0000

The content of this document is related to TYPO3, a GNU/GPL CMS/Framework available from www.typo3.org.

Table of Contents

What does it do? 

This extension (fal_securedownload) aims to be a general solution to secure your assets.

When you storage is marked as non-public all links to files from that storage are replaced (also for processed files).

The permissions for assets can be set on folder/file bases by setting access to fe_groups in the file module.

There is also a plugin to show your files as a tree on your website.

Features

• Restrict FE access on folder level
• Restrict FE access on file level
• Let editor set permissions in file list
• Force download for all files (for protected file storages)
• Force download for specific file extensions (for protected file storages)
• Keep track of requested downloads (count downloads per user and file)

Installation 

1. Install ext:fal_securedownload

   Download and install fal_securedownload through extension manager or clone from https://github.com/beechit/fal_securedownload.git in typo3conf/ext/

2. Create non public file storage (under rootlevel)

   Un-check the 'public' checkbox for your existing file storage or create a new file storage and set it to non public

   

   Best is to have the physical folder outside of your document root. If not, add an .htaccess with "Deny from all" (Apache < 2.3) or "Require all denied" (Apache >= 2.3) in your file storage root folder.

3. Configure lockRootPath !!! Required >11.5.35 & >12.4.11

   Refer to the TYPO3 Backend Configuration to ensure paths outside the project path are restricted for added security. https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Configuration/Typo3ConfVars/BE.html#confval-globals-typo3-conf-vars-be-lockrootpath

4. Set permissions

   Set fe_group permissions to a file or folder of the non-public file storage

   

   

FE File Tree 

The fal_securedownload extension comes with a filetree plugin you can use to display your folders/files as a tree in the frondend with force-download links.

fal_securedownload/Resources/Private/Layouts
fal_securedownload/Resources/Private/Partials
fal_securedownload/Resources/Private/Templates

plugin.tx_falsecuredownload {
  view {
    layoutRootPath = EXT:your_ext/path/to/your/layouts/folder
    partialRootPath = EXT:your_ext/path/to/your/partials/folder
    templateRootPath = EXT:your_ext/path/to/your/templates/folder
  }
}

Extension settings 

In the extension manager you find some options to define some of the behaviour of the extension:

/login/?redirect_url=###REQUEST_URI###

# Or a typolink
t3://page?uid=5&redirect_url=###REQUEST_URI###

/no-access/?redirect_url=###REQUEST_URI###

# Or a typolink
t3://page?uid=5&redirect_url=###REQUEST_URI###

EXT:ke_search support 

To have proper support for ke_search you need at least version 1.8.4 of ke_search and 0.0.8 of fal_secure_download.

EXT:solrfal support 

To have correct urls to indexed files you need to add/adjust following ext:solr typoscript configuration.

   # Make sure the correct public URL is indexed
plugin.tx_solr.index.queue._FILES.default.filePublicUrl = public_url
plugin.tx_solr.index.queue._FILES.default.url = public_url

   # Make sure the fe_groups are considered
   plugin.tx_solr.index.queue._FILES.default.access = TEXT
   plugin.tx_solr.index.queue._FILES.default.access {
       value = r:0
       override {
           cObject = TEXT
           cObject {
               required = 1
               field = fe_groups
               wrap = r:|
           }
       }
   }

This feature is sponsored by: STIMME DER HOFFNUNG Adventist Media Center

EventListeners 

services:
  Vendor\MyExtension\EventListener\BeforeRedirectsEventListener:
    tags:
      - name: event.listener
        identifier: 'myBeforeRedirectsEventListener'
        event: BeechIt\FalSecuredownload\Events\BeforeRedirectsEvent

<?php
namespace Vendor\MyExtension\EventListener;

   use \BeechIt\FalSecuredownload\Events\BeforeRedirectsEvent;

class BeforeRedirectsEventListener
{
       public function __invoke(BeforeRedirectsEvent $event): void
       {
           $event->setLoginRedirectUrl('XXX');
           $event->setNoAccessRedirectUrl('XXX');
       }

services:
  Vendor\MyExtension\EventListener\BeforeFileDumpEventListener:
    tags:
      - name: event.listener
        identifier: 'myBeforeFileDumpEventListener'
        event: BeechIt\FalSecuredownload\Events\BeforeFileDumpEvent

<?php
namespace Vendor\MyExtension\EventListener;

   use \BeechIt\FalSecuredownload\Events\BeforeFileDumpEvent;

class BeforeFileDumpEventListener
{
       public function __invoke(BeforeFileDumpEvent $event): void
       {
           $event->setFile('XXX');
       }

services:
  Vendor\MyExtension\EventListener\AddCustomGroupsEventListener:
    tags:
      - name: event.listener
        identifier: 'myAddCustomGroupsEventListener'
        event: BeechIt\FalSecuredownload\Events\AddCustomGroupsEvent

<?php
namespace Vendor\MyExtension\EventListener;

   use \BeechIt\FalSecuredownload\Events\AddCustomGroupsEvent;

class AddCustomGroupsEventListener
{
       public function __invoke(AddCustomGroupsEvent $event): void
       {
           $event->setCustomUserGroups($myCustomGroups);
       }

Known issues 

• I got javascript errors after including the provided typoscript template

This is properly because you do not have jQuery available on the FE. You can disable the provided javascript by adding this line to your typoscript template

plugin.tx_falsecuredownload.settings.includeJavascript = 0

• Files in my "secure" folder aren't processed by ext:tika

If the folder is outside of the document root you need to set $GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] else ext:tika will not process the files.

Todo 

Complete this document

Further development 

The git repository of ext:fal_securedownload can be found on Github.

Pull request and suggestions for improvement are very welcome.