Added a $enableDownloadFileEndpoint settings/config option (set to false by default) to control whether the download files action is publicly accessible

Author: Andrew Welch

src/Transcoder.php

@@ -55,6 +55,11 @@ class Transcoder extends Plugin
      */
     public static $plugin;
 
+    /**
+     * @var Settings
+     */
+    public static $settings;
+
     // Public Methods
     // =========================================================================
 
@@ -65,6 +70,8 @@ public function init()
     {
         parent::init();
         self::$plugin = $this;
+        // Initialize properties
+        self::$settings = self::$plugin->getSettings();
         // Handle console commands
         if (Craft::$app instanceof ConsoleApplication) {
             $this->controllerNamespace = 'nystudio107\transcoder\console\controllers';

src/config.php

@@ -54,6 +54,9 @@
         'gif' => '@web/transcoder/gif/',
     ],
 
+    // Determines whether the download file endpoint should be enabled for anonymous frontend access
+    'enableDownloadFileEndpoint' => false,
+
     // Use a md5 hash for the filenames instead of parameterized naming
     'useHashedNames' => false,
 

src/controllers/DefaultController.php

@@ -10,6 +10,8 @@
 
 namespace nystudio107\transcoder\controllers;
 
+use nystudio107\transcoder\Transcoder;
+
 use Craft;
 use craft\web\Controller;
 use craft\helpers\Json;
@@ -38,6 +40,18 @@ class DefaultController extends Controller
     // Public Methods
     // =========================================================================
 
+    /**
+     * @inheritDoc
+     */
+    public function beforeAction($action)
+    {
+        if (!Transcoder::$settings->enableDownloadFileEndpoint) {
+            $this->allowAnonymous = false;
+        }
+
+        return parent::beforeAction($action);
+    }
+
     /**
      * Force the download of a given $url.  We do it this way to prevent people
      * from downloading things that are outside of the server root.

src/models/Settings.php

@@ -22,30 +22,31 @@
  */
 class Settings extends Model
 {
-    // Static Methods
+    // Public Properties
     // =========================================================================
 
     /**
      * The path to the ffmpeg binary
      *
      * @var string
      */
+
     public $ffmpegPath = '/usr/bin/ffmpeg';
 
-    // Public Properties
-    // =========================================================================
     /**
      * The path to the ffprobe binary
      *
      * @var string
      */
     public $ffprobePath = '/usr/bin/ffprobe';
+
     /**
      * The options to use for ffprobe
      *
      * @var string
      */
     public $ffprobeOptions = '-v quiet -print_format json -show_format -show_streams';
+
     /**
      * The path where the transcoded videos are stored; must have a trailing /
      * Yii2 aliases are supported here
@@ -59,6 +60,7 @@ class Settings extends Model
         'thumbnail' => '@webroot/transcoder/',
         'gif' => '@webroot/transcoder/',
     ];
+
     /**
      * The URL where the transcoded videos are stored; must have a trailing /
      * Yii2 aliases are supported here
@@ -72,25 +74,34 @@ class Settings extends Model
         'thumbnail' => '@web/transcoder/',
         'gif' => '@web/transcoder/',
     ];
+
+    /**
+     * @var bool Determines whether the download file endpoint should be enabled for anonymous frontend access
+     */
+    public $enableDownloadFileEndpoint = false;
+
     /**
      * Use a md5 hash for the filenames instead of parameterized naming
      *
      * @var bool
      */
     public $useHashedNames = false;
+
     /**
      * if a upload location has a subfolder defined, add this to the transcoder
      * paths too
      *
      * @var bool
      */
     public $createSubfolders = true;
+
     /**
      * clear caches when somebody clears all caches from the CP?
      *
      * @var bool
      */
     public $clearCaches = false;
+
     /**
      * Preset video encoders
      *
@@ -123,6 +134,7 @@ class Settings extends Model
             'threads' => '0',
         ],
     ];
+
     /**
      * Preset audio encoders
      *
@@ -152,6 +164,7 @@ class Settings extends Model
             'threads' => '0',
         ],
     ];
+
     /**
      * Default options for encoded videos
      *
@@ -174,6 +187,7 @@ class Settings extends Model
         'aspectRatio' => 'letterbox',
         'letterboxColor' => '',
     ];
+
     /**
      * Default options for video thumbnails
      *
@@ -189,6 +203,7 @@ class Settings extends Model
         'aspectRatio' => 'letterbox',
         'letterboxColor' => '',
     ];
+
     /**
      * Default options for encoded videos
      *
@@ -202,6 +217,7 @@ class Settings extends Model
         'synchronous' => false,
         'stripMetadata' => false
     ];
+
     /**
      * Default options for encoded GIF
      *
@@ -263,6 +279,7 @@ public function rules()
             ['transcoderPaths', ArrayValidator::class],
             ['transcoderPaths', 'required'],
             ['transcoderUrls', ArrayValidator::class],
+            ['enableDownloadFileEndpoint', 'boolean'],
             ['useHashedNames', 'boolean'],
             ['createSubfolders', 'boolean'],
             ['clearCaches', 'boolean'],