Skip to main content

FluentForms

#General

Lead Capture: fulfill PDF download?

How do you obscure download links in form entry notifications?

I'm using FluentForms as a lead capture. Prospect lands on a form, fills in name + email, clicks submit, and is then sent a link to download a PDF.

I can embed the URL of the PDF in the email ({wp.site_url}/wp-content/uploads/Year/MO/FILE.pdf.

BUT this is a permanent link to the file, so anyone who downloads it can bypass the lead capture form and share the URL with the world.

I thought I might could get slick and create a hidden field with the URL, create a transient, and use a quick fluent snippet to rewrite the URL if it began with secure-download but the substitution isn't working in fluent snippets, for example:

add_action('init', 'register_pdf_download_rewrite');
function register_pdf_download_rewrite() {
add_rewrite_rule(
'^secure-download/([a-zA-Z0-9_-]+)/(.+.pdf)/?$',
'index.php?pdf_token=$1&pdf_file=$2',
'top'
);
}

SO, what is the best way you've found to deliver a PDF or other asset without exposing the URL to the public ?

  • 1 like
  • 8 comments

André Daus

You are looking for signed links. With signed links you can add a counter or timer for how long the URL will be valid. But you need custom coding for it. With FluentCart, it works out of the box, with FluentForms, you need some code.

Curtis Bingham

André Daus oh, that’sa helpful direction. I’ll look at those. FluentCRM is definitely hooked up, and is the next configuration step in the process

Thank you

Curtis Bingham

André Daus are you perhaps talking about Smart links? https://fluentcrm.com/docs/global-smartlinks-settings/

I didn't find anything about signed links.

André Daus

Curtis Bingham no, I meant signed links. A signed link (or signed URL) is a specially generated, tamper-proof URL that grants temporary, authorized access to a private resource like a cloud storage file or a restricted webpage without requiring the user to be logged in. It works by appending a cryptographic hash (signature) to the URL, which expires after a set time.

Curtis Bingham

André Daus that’s exactly what I need. No problem with doing custom coding. I’ll keep looking for a guide unless you happen to have one available. For some reason I initially read your post and assumed that feature was available in FluentCRM.

André Daus

Curtis Bingham no, I said it works with FluentCart. But it is basically just some params plus a signature in the URL.

Here is a basic code snippet to create one:

function generate_signed_link($email) {
    $secret  = wp_salt('auth'); // uses WP secret salts
    $expires = time() + 3600;   // valid for 1 hour

    $data = $email . '|' . $expires;
    $sig  = hash_hmac('sha256', $data, $secret);

    return add_query_arg([
        'email'   => rawurlencode($email),
        'expires' => $expires,
        'sig'     => $sig,
    ], site_url('/download/'));
}

And then check if the URL is valid:

function validate_signed_link() {

    if (!isset($_GET['email'], $_GET['expires'], $_GET['sig'])) {
        return false;
    }

    $email   = $_GET['email'];
    $expires = (int) $_GET['expires'];
    $sig     = $_GET['sig'];

    // 1. Check expiration
    if ($expires < time()) {
        return false;
    }

    // 2. Recreate signature
    $secret = wp_salt('auth');
    $data   = $email . '|' . $expires;
    $calc   = hash_hmac('sha256', $data, $secret);

    // 3. Timing-safe comparison
    if (!hash_equals($calc, $sig)) {
        return false;
    }

    return true;
}

That should get you going.

Cimbian UK Ltd

Could you use a numeric counter that is hidden and then conditional logic to display the PDF for download?

Increment the counter as each field is completed, including email verification and put the pdf in a modal for download, rather than email it.

Curtis Bingham

Cimbian UK Ltd that's a creative solution!