內容簡介
「私有」上傳的檔案（PDF、圖片等等）通常只會包含在私有的文章和頁面中。不過，如果有人知道相對應的 URL，仍然可以存取這些檔案。
例如，一個 PDF 檔案的 URL 可能是
http://example.com/wp-content/uploads/minutes-20160924.pdf
任何人都可以下載該檔案，因為 WordPress 沒有機會檢查其授權。
「私人上傳」外掛解決這個問題的方法是將所有私有檔案移動到另一個資料夾中，並配置網頁伺服器以要求 WordPress 驗證對那個資料夾中的檔案的存取權。
因此，這個檔案的 URL 現在可能是
http://example.com/wp-content/uploads/private/minutes-20160924.pdf
一個 HTTP 伺服器重寫規則會將其轉換為
http://example.com/?pucd-folder=private&pucd-file=minutes-20160924.pdf
「私有上傳」外掛會攔截該 URL，並以 403 狀態碼拒絕存取。
這個外掛比一些類似的外掛更有效率，因為它只需要在服務私有資料夾中的檔案時運行：網頁伺服器會直接處理其他上傳的檔案（不在私人資料夾中的檔案）。
需求
足夠的訪問網頁伺服器以允許所需的配置。
致謝
這個外掛靈感來自於在 StackExchange 上的一次討論。
未來計劃
目前，對私有檔案的存取只取決於 is_user_logged_in() 函式。此外掛可以進一步發展，提供更細緻的控制，例如為每個使用者建立一個資料夾。
外掛標籤
開發者團隊
原文外掛簡介
‘Private’ uploaded files (PDFs, images, etc.) will normally be only included in private posts and pages. But the files themselves can still be accessed by anyone if they know the corresponding URLs.
For example, a PDF file’s URL might be
http://example.com/wp-content/uploads/minutes-20160924.pdf
and anyone could download that file because WordPress does not get a chance to check their authorisation.
The solution that the Private Uploads plugin uses involves moving any private files to a separate folder, and then configuring the web server to ask WordPress to authenticate access to files in that folder.
So the file’s URL might now be
http://example.com/wp-content/uploads/private/minutes-20160924.pdf
and an HTTP server rewrite rule will convert this to
http://example.com/?pucd-folder=private&pucd-file=minutes-20160924.pdf
The Private Uploads plugin will intercept that URL and reject it with a 403 status code.
This plugin is more efficient than some similar ones because it only has to run when serving files in the private folder(s): the web server handles other uploaded files (ones not in the private folders) directly.
Requirements
Sufficient access to the web server to allow the required configuration.
Acknowledgements
This plugin was inspired by a discussion on StackExchange.
Future Plans
Currently, access to private files just depends on the is_user_logged_in() function. This plugin could be developed to give more fine-grained control, such as having a folder for each user.
