How to only access a page through drupal_goto() function?

Question

I have a form setup so that when the user enters the correct serial #, they are redirected to the download page.

I don't want the person accessing the download page directly or sharing with anyone else through the URL, as this will bypass the serial validation.

How can this be done in Drupal?

Answer 1

Below is a solution that should work for users who are logged in (using Drupal 7, I assume).

Use the Content Access module to limit access to your download page to only those users who have a role like (say) "DownloadAllowed". Since you want to protect that download page, you'll need "some" access module.

And use the Rules module to implement a rule like so:

Step 1: Store your serial number (entered when your form is submitted) in a field which will be used in the next step. Even though you can use any "machine name" for that field, let's assume you call it "field_serialnr"

Step 2: Use a variation of the Rule included in my answer to "How to specify a Rules condition related to select list values?". Here is what you should tune in that rule:

• Replace the Rules Event to something like "After saving new content (of some type that matches your form)".
• Replace the "Value C" in the Rules Condition to the value of your serial nr.
• For debugging reasons, start with a Drupal message to be shown (to ensure your rule works correct if the serial nr is ok, and to also verify it works as you want if the serial nr is wrong or missing). After the message shows up as you want it to show, replace the Rules Action with something like "Assign role to user". The role to assign is ... you probably guessed it ... "DownloadAllowed".

With that, those users who entered your serial nr correctly, will just-in-time get permission to access the download page. Those who didn't will be stopped by the Content Access module ... Which is exactly what you want.

PS: for anonymous users trying to access your download page, you could create another Rule to set a Drupal message indicating that they must be logged in before they can access that download page. For that, just use Rules Event "Drupal is initializing" and a Rules Condition to check if the URL they entered matches the one from your download page.