Disallow access to member files when they are in public file system

Question

I have case where I want to make it impossible for the users to access file directly (http://www.mydomain.com/members/file.pdf), but want to allow downloading this file only if link is displayed on Drupal page, that user has privilege to see.

I know it can be easily done if those files are outside webroot and defined as private filesystem.

But is there any alternative solution, Apache way, php/Drupal way to achieve this for files that are not in private filesystem?

Those member files are of various extensions, so I could not just disallow by extension.

I have asked simmilar question before, but as I understood, proposed hook_file_download way works only for private file system setup.

Answer 1

To Apache or any other web server, seeing

<img src="http://www.foo.com/bar.jpg">

in html and a user typing http://www.foo.com/bar.jpg into their browser directly is basically the same thing so the quick answer is "no, not really, at least from a drupal standpoint." You could obfuscate the path with some javascript trickery but that's about it.

Now, you could look into Apache referrer access, a quick link about allowing access from specific referrers might shed some possibilities on it for you, but now you are certainly outside of drupal :)