5.0.d security issue with internet download manager

[samirastucia]

Hello every body,

I made an alfresco 5.0.d new installation in windows server 2012 R2, i revoked the download action for site consumers, but for those who have IDM (internet download Manager installed in their browser), the browser promt for download the pdf file even if there is no download button.

Can some one tell me how to prevent this issue?

Thank you very much for your help.

[afaust]

Hello,

if you don't want tools like IDM to be able to offer download to those types of restricted users, you must completely remove any potential URL reference to the actual document download from the page. This also includes disabling the PDF / document previewer which internally "downloads" fragments of the document for display and uses an URL reference that would allow full download. IDM very likely picks up this URL and provides the download option based up on that.

Regards
Axel

[samirastucia]

Thank you Axel for your reply,

What if we use a SWF previwer instead of the pdfjs ?

[afaust]

The SWF previewer would likely still result in IDM providing a download option, but the downloaded file will be a reduced quality rendition of the original document.

Technically, as long as you expose any previewer capability, IDM is likely to provide something to download. Even if that is only a rendition, the URL provided can be manipulated by users to still download the original document. Everything you are doing to restrict the ability of download is only UI focussed. Technically, if a user has READ access to a document inside Alfresco and is somehow able to piece together the URL to it, they can download it (the URLs aren't that complex either).

Regards
Axel