relocating files for downloading

There is a directory a download directory under admin. Is this the directory we should store our downloads in so that they can be secure.

Thank you
LadyDee

If you mean you have a directory:
/admin/download

that did not come with Zen Cart ...

If you mean you see a directory on the same level as:
/admin
/download
/email
/includes

then that is the Download Directory that comes with Zen Cart ...

It is setup with an .htacess file and index.html file to prevent direct access to the files ...

Ajeh:

It is setup with an .htacessThe trouble is that some server systems ignore the .htaccess file. This leads to the situation that customers can download files for free if they guess the file names.
E.g. a customer already bought one mp3 song, and he got a file with the name "track01.mp3". So he might guess there must be a track02.mp3, a track03.mp3 a.s.o., and if he finds out you use Zen Cart, it is easy for him to steal all the files.
In fact, when I access my download directory using a standard browser, I can download any file as long as I know the file name. I don't need to log in.

There are two solutions I can think of:

1. rename every downloadable file by hand. "track02_dkfjsdfkdsj.mp3" or something like that.

or
2) rename the download directory. Or better, move it outside your http area. This works as long as the files are still on the same server. But before, read the FAQ:
https://www.zen-cart.com/tutorials/index.php?article=280

By reading the above I am assuming this download folder can be anywhere else on my site? I have other pages that are out there before the actual store, so this would be the best place to put the download folder is that correct then just point to it.

Thank you
Ladydee

burt:

The trouble is that some server systems ignore the .htaccess file. This leads to the situation that customers can download files for free if they guess the file names.

I cannot do that on my site ... I get blocked if I type in the direct path to anything in the /download directory ...

Are you on a windows or unix server?

deemurphy:

By reading the above I am assuming this download folder can be anywhere else on my site? I have other pages that are out there before the actual store, so this would be the best place to put the download folder is that correct then just point to it.

Thank you
Ladydee

The tutorial shows how to secure your download directory ... you might try that and see if it works for you ...

deemurphy:

By reading the above I am assuming this download folder can be anywhere else on my site?
Yes, it can be everywhere on the same server. It cannot be anywhere outside the server. ZenCart is not designed to use a link for downloads.
Note: Windows servers require funny pathnames, e.g. D:/windows/customer1/www.mysite.com/zencart/downloads
or something like that.
And beware: some servers restrict execution time to 300 seconds, some even to only 60 seconds. So if your downloads always abort after a certain period of time, you have a problem with server variables like max_execution_time or even worse, HTTP_KEEP_ALIVE. I have not found a safe work-around so far.

Ajeh:

I cannot do that on my site ... I get blocked if I type in the direct path to anything in the /download directory ...

Are you on a windows or unix server?
I am on a windows server. That is the trouble. Windows servers ignore .htaccess files.
But the HTTP_KEEP_ALIVE problem exists on linux servers, too, I think.