.htaccess and download folder

[trishah]

I have been working on securing the download folder. I've been able to move it behind the public_html but I'm confused about the .htaccess file...

In the article https://www.zen-cart.com/tutorials/i...hp?article=121 "How do I secure my Downloads folder to prevent theft?" it says:

Zen Cart already provides .htaccess protection for that folder. You could (should) update that file to add the file-extensions for all the types of files in your downloads folder. Thus, people using a browser cannot directly access any files matching those extensions.

I have been doing some research and I'm not sure how to "add the file-extensions". Do I just list the them? Use commons? Have to give it some instruction beforehand?

Here is the download folder .htaccess as it sits. If I want to add, say, .zip and .exe to is how would it look?

#prevent directory browsing -- for security
IndexIgnore */*

AuthType Basic
AuthName "No access"
AuthUserFile .htnopasswd
AuthGroupFile /dev/null
Require valid-user

[kobra]

If you have relocated it above public_html then you do not require any additional web access measures as it is up out of normal web access space

[trishah]

I'm sorry for not being clear. I skipped over an important piece of information...

The site ZenCart is on is a subdomain of my main hosting account.
After moving the download folder behind public_html I realized that the only way to upload files there would be to give the person running the site full access to all my domains, which I am not prepared to do. So I moved the download folder into my main hosting account (one level up from the site ZenCart is on) and gave him ftp permission for that folder only.

So I still need to know how to add the file extensions to the .htaccess.

TIA!

[kobra]

Guess I am confused now???

Are you trying to force "download of file types" or upload?

If as the thread is titled "download" it would be along the lines of

AddType application/octet-stream .mov
AddType application/octet-stream .avi
AddType application/octet-stream .mpg
AddType application/octet-stream .jpg
AddType application/octet-stream .mp3

Where your files types are listed one per line

[trishah]

I'm trying to follow the instructions in the article that says:

You could (should) update that file to add the file-extensions for all the types of files in your downloads folder.

I gave you the information about unloading because that is the explanation as to why I still needed the information after you told me that I didn't need it anymore...

Bottom line: Is the code you offered in your last post what they were referring to in the article?

Oh, and I read somewhere about using the word "stream" only being necessary on Windows servers. The site is in Linyx.

[kobra]

Yes and octet-stream is used to force ONLY downloading

[trishah]

Great. One last point...

I assume that it will also work for:

AddType application/octet-stream .zip

Correct?

[DrByte]

I believe the FAQ article was referring to preventing Directory Listings more than specifying how certain filetypes are to be served.

If you're serving your files via redirect, then any AddType directives in your /download/ folder will be entirely ignored because the files are served from the /pub/ folder as part of the redirect. And if using Download by Streaming, then the AddType directives are also moot because the streaming is done by PHP, not by the filesystem or Apache.

[trishah]

Ahhh... I understand now. Thank you for the additional information.