Česlav Przywara

Sadly, this is still an issue despite plugin claims compatibility with WP 4.6.1… :/

Hi, this has been reported before, please see the following thread.

Hi Maurice,

Since I wrote this stupid code, I feel obliged to chime in.

When I enter a path to a file outside the web root (to prevent direct access), I cannot download it.

That’s expected behavior, the plugin supports neither using file path nor dispatching files from outside of the WordPress content directory.

The reason for not supporting file path is mainly historical – dispatch feature is relatively new and before it has been added, you had to use file URL even for local downloads. Since the edit screen UI doesn’t support inclusion of file path, neither does the dispatch routine.

The reason for limiting dispatch to files in content directory is a matter of basic security. Would you like your authors to be able to create download link to your wp-config.php? Maybe you are the only user of your website, so you don’t care, but you’re not the only user of this plugin.

Anyway, your use case is legitimate and it would be relatively easy to add support for custom folders to the plugin. It’s a pity you just haven’t asked for it – I could have implement it instead of replying to your lament 😉

When I enter a path to a file inside the web root (somewhere in the wordpress uploads directory), I CAN download the file, but it’s always ZERO bytes.

Maybe you could give us more details on your webserver setup or why flushing the output buffer before actually outputting file contents is necessary in your case? It really interests me, because I don’t see why your change should fix anything, but I cannot replicate your problem without more information.

The ob_end_clean function clears the output buffer and stops output buffering. Clearing is done just in case to avoid any empty lines etc. output by accident before the dispatch routine runs to be prepended to contents of download file. Stopping output buffering is necessary to avoid memory issues, when large files are dispatched.

When I click to upload a file, the file is uploaded indeed, but when I click insert, the field where the path to the file should appear remains empty.

This is a bit confusing and the UI would benefit from some improvements here: you have to fill in “Link URL” field first, otherwise nothing is inserted. In other words, first click on “File URL” button (you want to link to the file URL), then on “Insert into Post”.

Cheers,
Česlav

Well, the reason why I had never used “instant lockout” is that any mistyped or mistaken username is immediately blocked and on my websites it would do more damage than good.

The idea here is to only block IPs that try to log in using specific usernames (configured in plugin settings). I’ll have a look how hard this would be to implement.

Ok, that is the reason. Password protected downloads can be opened only in the same window in the moment, although it is technically possible to open them in new window. Perhaps this functionality will be added in some future version of the plugin.

Thanks, this was helpful! I found the source of this issue.

I’ve submitted a patch, it should be fixed in the next version of the plugin. Meanwhile, you can fix the problem by explicitly including button_text="Download now!" in your shortcode:

[sdm_show_dl_from_category category_slug=”produkt-datenblaetter” fancy=”1″ button_text="Download now!"]

I use BBQpro on my WP websites, in those I am also installing and configuring AIOWPSF.
Is that a good idea? does it gets redundant? known conflicts?
Are BBQpro and “Enable 6G Firewall Protection” in AIOWPSF the same thing?

I don’t know BBQpro that well, but I assume that its built around rules from his 6G firewall. So I would say having 6G enabled in AIOWPSF adds nothing more to site security when you have BBQpro active.

Optionally, to force WP to always send email as “wordpress@your-site.com”, just use the following:

function fix_wp_mail_from() {
    return 'wordpress@your-site.com';
}
add_filter('wp_mail_from', 'fix_wp_mail_from', 10, 0);

This is more future proof solution as it keeps working even if you change your admin email address.