CGI downloadable goods help

[John McKenzie]

Hello.

I am helping someone build a website that sells one product, a
downloadable book. It would be nice to sell the hard copy version as
well, but the digital copy is what we are mostly concerned about. As I
have done some scripting in my life, but not allot, and none of it was
ecommerce related I am seeking help. With the appearent demise of
comp.infosystems.www.cgi I am hoping someone here can help and does not
mind the topic being posted here.

We are setting up an account with a payment processor. You click a link,
go to their hosted payment form and fill out the payment details. If
accepted you are sent to a web page I chose, and if decline you are sent
to a different page I can also choose. The decline one will be a static
page saying you are declined and providing a link to try again. The idea
for the accepted page would be to send the user to a CGI script I host.

At this point I would like to know what to do conceptually. I will take
my meagre scripting skills and learn more in order to write this once I
know what to do.

Looking for guidance, suggestions and to learn how these things are
generally done.


So the user gets refer by the hosted payment page to my script. It needs
to give them the file they paid for without giving the info to get the
file for free in the future. Send them a time limited URL would probably
be the best way to go. If so, how do those get made?

Here is a guess at one way to do it.

Script creates random number, say 12345.

Script creates a file called 12345 which is a symlink to the real file
to download.

Script creates a web page whose content is a hyperlink to the symlink.

Script emails URL to web page to customer.

Cron job once a week deletes any pages that were created by the script
and are more than say 5 - 7 days old.


Is this a normal, good way to do it? Is that how these things would
normally work?

Thanks, everyone.

[Eli the Bearded]

Post by John McKenzie
So the user gets refer by the hosted payment page to my script. It needs
to give them the file they paid for without giving the info to get the
file for free in the future. Send them a time limited URL would probably
be the best way to go. If so, how do those get made?

Two easy ways that I have used to create a limited use URL:

1) Encrypt a time stamp and use it as a parameter. Unix seconds since
epoch say "1296794750" encrypted to say "o2tgp2IwpzI0YGRlBGL3BGD3AGNX"
(that's really encrypted, but it is a very weak cipher) gives a
possible URL:

http://www.example.com/download/o2tgp2IwpzI0YGRlBGL3BGD3AGNX/filename.ext

I'd have /download a ScriptAlias to the actual script, in Apache
httpd.conf eg:

ScriptAlias /download /home/httpd/cgi-bin/download

The parameters would be passed in as the PATH_INFO environment variable.
Parse the PATH_INFO, decode the encrypted part and compare against
the current time. If it's over a day expired, say, reject.

2) Put the time and a verification string in the CGI parameters. This
tends to be easier, but doesn't look as nice. For your timestamp
1296794750, you would take that string and make a secret hash of it.
Then pass in both the time and the hash and verify that the hash
matches the string. My typical way to make a hash is to MD5 with a
secret:

:r! echo 1296794750-SuperSecretPassphraseHere | md5
6504aeffa5a424606ced44e3e569c25c

That's a bit long, you can shorten it in half without losing too
much security. So then your URL might be:

http://www.example.com/download/1296794750/6504aeffa5a42460/filename.ext

Your CGI would check if the time has expired and if not recreate the
hash and see if it matches. MD5 is widely available, so these types
of URLs are easy to create and verify.

In both cases after verification, the script would set the response
headers and then write the file to the browser.

Post by John McKenzie
Script creates random number, say 12345.
Script creates a file called 12345 which is a symlink to the real file
to download.
Script creates a web page whose content is a hyperlink to the symlink.

Yeah, you can do that. A symlink to the directory with the file, and
the filename in the URL would be nicer. That gives you a good default
filename for the downloading user. Make sure that the server isn't
going to give out an autogenerated index of files in the directory.
And if your delete script breaks you lose the time protection.

Post by John McKenzie
Script emails URL to web page to customer.

Email? People probably want you to redirect to the page immediately.

Elijah
------
hasn't poked into this group in a while

[John McKenzie]

Eli the Bearded:

Thank you for replying to my post. Things were slow so I was not
checking the newsgroup that often, should have been here sooner.

It seems I was on the right track, thank you for telling me that, the
details of how you do it and advice. I need some time to absorb it and
try it out and so on.

Thank you for your help.