cflocation to a file located 'above' the httpdocs folder

Question

hi guys, i got a tricky one here...
users can upload word documents (.doc) to my server (using
cffile).
the idea is to only allow certain users access to those
documents, therefore i am thinking that storing them 'above' the
httpdocs folder is probably a wise move (that way no one can get to
them using httpaccess, right?)
i can write the files to my desired location using <cffile
action="copy"... just fine
the problem arrises in giving (the authorised) users access
to those documents.
i want them to be able to download those documents via their
browser and had planned to do so using <cflocation
url="#absoloute-path-to-required-document-on-server.doc#" >
it seems this works fine if the file is within the httpdocs
folder, but not if it's above it..
does anyone have any suggestions?
i'd be very grateful of any input whatsoever (if you think
i'm tackling this the wrong way for example, i won't be offended :)
thanks very much indeed.
kind regards
Nick

Answer 1

> P.S. If you want clean downloads using the
<cfcontent...> method there
are some headers you would probably want to set as well to
inform the
browser the proper file name and extension of the download.
This is
well discussed and blogged all over the internet and full
examples are
plentiful.
Ian, do you mean like the <cfheader...> tag I posted in
my original reply?
<cfheader name="Content-Disposition" value="inline;
filename=document.doc">
The full code I use to push files to users is as follows.
Save this as getFile.cfm, update the fileshareroot variable, update
the code that checks that the user has valid access rights, and
access by sending a user the url:
http://myserver.com/getFile.cfm?filename=myFileToGet.ext
<cfparam name="filename">
<cfset fileshareroot="/my/fileshare/root">
<!--- verify user can access this file. --->
<cfset validAccess = false>
<cfif userCanAccess> <!--- must be customized
--->
<cfset validAccess = true>
</cfif>
<cfif not validAccess>
You are not authorized to view this document.
<cfabort>
</cfif>
<!--- verify document exists --->
<cfif not FileExists("#FileshareRoot#/#filename#")>
The document you requested doesn't exist.
<cfabort>
</cfif>
<!---
// getContentTypeFor() uses mime types from
// JAVA_HOME/lib/content-types.properties or
// JAVA_HOME/jre/lib/content-types.properties
--->
<cfset URLConnection =
CreateObject("Java","java.net.URLConnection")>
<cfset myMimeType =
URLConnection.getFileNameMap().getContentTypeFor(filename)>
<!--- if the file extension isn't found in
JAVA_HOME/jre/lib/content-types.properties, then myMimeType isn't
defined. Set it to text/plain --->
<cfif not isDefined("myMimeType")><cfset myMimeType
= "text/plain"></cfif>
<cfheader name="Content-Disposition" value='inline;
filename="#filename#"'>
<cfcontent type="#myMimeType#" deletefile="No"
file="#FileshareRoot#/#filename#">