using Microsoft.AspNetCore.Mvc; using Umbraco.Cms.Core.Services; using MimeKit; using Umbraco.Cms.Core.Models; using Umbraco.Cms.Core.IO; namespace UmbracoProject.Controllers { public class SecureMediaController : Controller { private readonly IMediaService _mediaService; private readonly IMemberService _memberService; private readonly MediaFileManager _mediaFileManager; public SecureMediaController(IMediaService mediaService, IMemberService memberService, MediaFileManager mediaFileManager) { _mediaService = mediaService; _memberService = memberService; _mediaFileManager = mediaFileManager; } public ActionResult Index(string id, string file) { // reconstruct the media path and retrieve it string mediaPath = $"/media/{id}/{file}"; var media = _mediaService.GetMediaByPath(mediaPath); if (media == null) return NotFound(); // THE FOLLOWING BIT IS UNTESTED AS I AM DOING SOMETHING ELSE HERE if (media.IsProtectedMedia()) { // check if the user has right roles if (!this.HttpContext.User.IsInRole("YourRole")) { // otherwise redirect return Redirect(Defaults.LoginRoute); } } // UNTESTED BIT ENDS if (_mediaFileManager.FileSystem.FileExists(mediaPath)) { var fileStreamReader = _mediaFileManager.FileSystem.OpenFile(mediaPath); var mimeType = MimeTypes.GetMimeType(file); return new FileStreamResult(fileStreamReader, mimeType); } return NotFound(); } } }