Hi,

As this module uses UID to track downloads, how does it behaviors with anonymous users?

I mean, all them are user 0, and the hash generated by this module only looks at uid, fid and vid.
I know ip is being captured, but shared computers on the same network have the same ip.

And at report's page, you can't identify correctly how many anonymous downloaded the file.

So, this module shouldn't be using session id?
Is there a reason to avoid it?

thanks

Comments

fietserwin’s picture

Issue #1352480: Adding form data to file field stats of the Squeeze module asks more or less for the same. Not so much regarding the hash but more regarding the statistics, So if an e-mail address is available in the session, e.g. via the squeeze module, the uid should be accompanied with the e-mail address (or name field or whatever other field is deemed to "identify" the anonymous user.

I will see if I can make some time to have a look at these issues and propose a patch.

hixster’s picture

Fietswerin - thanks for your response in the squeeze issue queue and for posting here - would be great to get a patch for this.
It's seems reasonable to want to store data from the webform, as I guess most user will be using squeeze & ffs to remove the need to register.
@nicolasthompson would be great if you could point us in the right direction on this.

Cheers

fietserwin’s picture

Assigned: Unassigned » fietserwin
Category: bug » feature

This actually is a feature request, not a bug. Adding the hash was done to prevent scanning the "filefield_stats directory" but has no further real use and it can be questioned whether this module should add this prevention at all. This module should:
- count downloads of files, both on the public and private download method (admin/settings/file-system/settings).
- prevent guessing the original file name of files on the public file system as that would make it possible to circumvent the download counting (because, if you know the URL, public files can be downloaded directly).

Anyway, bug or feature, if we want to distinguish anonymous users in the statistics, we have to add additional information we have about that user, e.g. a name or e-mail address as filled in in a comment or webform. This information can be
- pulled from the session.
- pushed by another module by a hook we provide.

The first would require some configuration to allow administrators to specify what property of the session and how to name it, the latter some changes in our and other modules.

Implementation wise:
- how many extra pieces of information do we want to store?
- do we want to store a configurable label with that additional information?
- do we implement pulling it from the session?
- do we implement a hook to allow other modules to push it?

My answers would be: 2, yes, yes, yes. What would yours be? Or do you see other solutions? Please let us know before we start implementing it.

hixster’s picture

fietserwin thanks for coming back to me on this and for considering to do it. I agree with your choices, I think we'll need 4 pieces of information,although i'm sure most will need 2.

For our own needs we require:

Name
Email address
Telephone
Company Name

Thanks again.

fietserwin’s picture

And thanks for reacting. Those 4 are typically what is filled in on the Squeeze webform. IMO, the statistics only have to store the "identifying" fields that allow to relate downloads to webform submissions. For typical webforms, the e-mail address will be enough to uniquely "identify" the anonymous person, so I guess that just one piece of information suffices, but will settle for 2.

hixster’s picture

Ok cool - I'm sure we'll be able to extend the module for our own needs.
Thanks again :-)

hixster’s picture

Hi fietserwin,
Have you had a chance to make these modifications?

fietserwin’s picture

Not yet, I hope to be able to do some more work on this module next week.