Download Security Issue

[John44]

Download Security Issue

I have just started using Zen Cart version 1.3.0.2 and I am very impressed, but I have discovered a problem.

When you create a virtual products using download attributes customers are able to download a product as much as they like by using the following as an example:

www.websitename.co.uk/download/product.zip

I am using Microsoft-IIS/6.0 web server with “Attribute Settings > Download by Redirect” turned off. I have turned this option off because it corrupts the zip file when customers download products. Even when redirect is turned on the url mentioned above will bypass security. I have a .htaccess file in my download directory, but this does not offer any protection. This a real problem because customers can easily work out the url they need to download files.

Does anyone know a security fix?

[DrByte]

Download by redirect (which windows servers can't usually provide) is much more secure than without redirect.

However, it's true that if a user understands Zen Cart infrastructure, they could perhaps figure out how to download directly from the "downloads" folder.

Given that scenario, the following options are available:

1. Zen Cart already provides .htaccess protection for that folder. You could (should) update that file to add the file-extensions for all the types of files in your downloads folder. Thus, people using a browser cannot directly access any files matching those extensions. Granted, if you have redirect off, this may pose a problem. And of course, only works if .htaccess is fully supported on your server.

2. If you are using redirect or streaming then moving the "downloads" folder into a place outside your webroot will prevent anyone from ever accessing the files with a browser unless they are using the Zen Cart-supplied links in their order details. This is the most secure approach. It requires physically relocating the folder, and editing your configure.php files to point to the real location of your downloads folder so that Zen Cart has a clue where to find the files it will be streaming to your users. This works on both Windows and Linux/Unix hosts.

[John44]

Thank you for all your help, placing the folder outside the webroot worked a treat.