File is accessible with url when not logged in | WordPress.org

Resolved jwiere03
(@jwiere03)

5 years, 3 months ago

I used this plugin a couple of years ago and I’m testing it for a new project I am working on. I have set the permissions for both the category and the file and initially it looked like it was working as it should. If I was logged with the correct user role I could download the file and if I wasn’t logged in I couldn’t. However when I tested the url xxx/wp-content/uploads/download-manager-files/Agenda.pdf I can download the pdf even if I am not logged in. Is there anyway to secure this or are all of the files accessible to anyone who has the direct url?

Viewing 4 replies - 1 through 4 (of 4 total)

Plugin Contributor W3 Eden, Inc.
(@w3eden)

5 years, 3 months ago
WPDM uses .htaccess file to block direct http access to download-manager-files dir. Inside that folder there should a .htaccess files with the following code:
```
RewriteEngine On
<Files *>
Deny from all
</Files>
```
Thread Starter jwiere03
(@jwiere03)

5 years, 3 months ago

Ok, I tested it on a local environment and it works. Unfortunately the site we wanted to use this for is on nginx so the .htaccess file isn’t doing anything.

Plugin Contributor W3 Eden, Inc.
(@w3eden)

5 years, 3 months ago

Hi,
In that case, please follow:
https://www.wpdownloadmanager.com/doc/how-to-protect-download-manager-files-directory-in-nginx/

Thread Starter jwiere03
(@jwiere03)

5 years, 3 months ago

Like a lot of WordPress websites this one is on WP Engine. I used their Redirect Rules to create this regex redirection (I just redirect back to the homepage) and during some brief initial testing this seems to work.
/wp-content\/uploads\/download-manager-files(\/(?i).*)$

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘File is accessible with url when not logged in’ is closed to new replies.

Tags

In: Plugins
4 replies
2 participants
Last reply from: jwiere03
Last activity: 5 years, 3 months ago
Status: resolved