403 Forbiddden error Product Download

After making a payment through PayPal I am brought back to my download page. When I click on the download link for the pdf file I get this error.

403 Forbidden
You don't have permission to access /pub/.wwphhmgitwksbjcfo/xxx.pdf on this server.

I contacted my host because I read in this forum that A 403 error means that rules in the webserver software prohibited you from doing what you were attempting. My host replied they couldn't help me because it was a configuration error.

My site is a fresh install, no addons I am running version v1.3.9h

In Attribute Setting I have
Enable Downloads = True
Download by Redirect = True
Download by Streaming = false
Download Expiration number of Days) = 0
Number of Downloads Allowed - Per Product = 6

A default install of v1.3.9h includes "pdf" as a permitted filetype. However, if you've changed that file or you've left an old version of that file on the server then you might have problems.
And, if your server's configuration (not in your control) prevents generation of symlinks, then the Download by Redirect method (which is the more secure approach, hence it being the default) won't be able to work. If your host is incapable of fixing that, then you may need to turn the redirect off and run in a less secure mode.

The server's logs will tell you the actual cause of the error, if the server admin has configured the server with normal traditional logging settings.

Thanks DrByte.

I don't believe there is a configuration problem as my host suggested. I think my host is blocking the htaccess files from working.

I just uploaded some custom error pages and a htaccess file for the root folder. The custom error pages are working so I've informed my host again. If they fix it so the htaccess files work, maybe my download problem will be solved.

The .htaccess files supplied with Zen Cart contain guidance on technical requirements upon the server. Those might be useful to share with the host, to see whether they are able to accommodate your technical needs.

Additional information is also available here: https://www.zen-cart.com/tutorials/index.php?article=287

Still no progress on getting a pdf to download.

My host commented something in the htaccess file and the pdf file downloaded. I was happy until he said it meant everybody could download the file.

Now I am trying to comment like he did but I don't really have a clue what I'm doing. I'd like to comment so the file will download, then I can gradually put the file back to it's original code until the download stops working.

What he did was put # in a lot of places to make the pdf download. I've tried putting # in lots of places but I still get the forbidden page.

Can somebody tell me how and where to comment in the htaccess file in the pub folder so the pdf can be downloaded by anyone.

Thank you.

Just rename the /pub/.htaccess file to .htaccess_OFF and that will disable all the protections it offers.

If your host doesn't understand anything about .htaccess, then they really ought not to be doing hosting in the first place.

The strange thing is I have another two sites with this host. both sites are running Zen Cart and working perfectly. That's why I don't understand why this new site is having problems with the download link.

My host has different servers. One of my sites is on .net the other on .biz both these sites work perfectly with Zen Cart. The new site is on .com and I'm having the problem with the site running on the .com server.

I renamed the file to .htaccess_OFF and still got
Forbidden
You don't have permission to access /pub/.zszyzkwjvjlucrjxo/Test.pdf on this server.

So I don't know what my host tech did to make it work so anybody could download the pdf.

Below I have two comments from my support ticket at my host.

My host Tech support said...
I noticed that in folder 'pub' of your website there is an .htaccess file which blocks the direct access through the web. I am not sure how exactly your script should work, but if you disable this .htaccess the 'pub' folder becomes accessible. However, since this is protected area I assume that your script should make an exceptions only for particular directory and most probably there is a issue with the script itself

A different support tech said...
The reason for the error is that the downloadable products option is not configured correctly, however I am unable to assist trouble shooting this further as this is not a part of our services.
I would suggest you to look for the right solution in the script support forum at http://www.zen-cart.com/forum/

Why would I still be getting the 403 forbidden page when .htaccess_OFF

I just got a friend to try the download link with the file set to .htaccess_OFF and she got the forbidden page too.

blue-grape:

My host has different servers. One of my sites is on .net the other on .biz both these sites work perfectly with Zen Cart. The new site is on .com and I'm having the problem with the site running on the .com server.

COM has nothing to do with the server... it is just part of the domain. are all your sites located on the SAME host server? Or are they each on different servers?

blue-grape:

My host Tech support said...
I noticed that in folder 'pub' of your website there is an .htaccess file which blocks the direct access through the web. I am not sure how exactly your script should work, but if you disable this .htaccess the 'pub' folder becomes accessible. However, since this is protected area I assume that your script should make an exceptions only for particular directory and most probably there is a issue with the script itself

A different support tech said...
The reason for the error is that the downloadable products option is not configured correctly, however I am unable to assist trouble shooting this further as this is not a part of our services.
I would suggest you to look for the right solution in the script support forum at http://www.zen-cart.com/forum/

We ONLY host with people who know eCommerce and (preferably) zencart too.

This policy has seen ALL of our sites run practically flawlessly for many, many years.

The tiny bit more we pay for good hosting has possibly saved us tens of thousands of pounds in potential down-time, and ignorant support teams at a host who basically does not know much at all.

There is no substitute for a good, and knowledgeable host...

schoolboy:

COM has nothing to do with the server... it is just part of the domain. are all your sites located on the SAME host server? Or are they each on different servers?

All our sites are hosted at the same place. Where I am getting confused is, when I login to our host one site logs in to a .biz, on another site when I login it is .net and the new site is .com so does this means there are three different servers our host is running?

If I try to login at the .biz login page with the site that logs in at .net I get a notice that the login is incorrect. It sounds like the host has different servers. You would think the three sites would use the same login page but they don't.

blue-grape:

All our sites are hosted at the same place. Where I am getting confused is, when I login to our host one site logs in to a .biz, on another site when I login it is .net and the new site is .com so does this means there are three different servers our host is running?

If I try to login at the .biz login page with the site that logs in at .net I get a notice that the login is incorrect. It sounds like the host has different servers. You would think the three sites would use the same login page but they don't.
Yes, all of that could very well indicate that they have different servers.
And, if your "broken" site is on a different server from your "working" site, then it just might be a server configuration problem that's breaking things.

It should be your host whom you're asking about that though, since they'll know for sure how many servers they've got.

If your host can't accommodate the security provided by using download-by-redirect which serves the files securely from the pub folder, then set your download-by-redirect to False, and then they'll be served from the /download/ folder instead. This does mean that your customers can share the download links with their friends though, so there's no security around potential theft. It might buy you some time to find out why your host's server configuration is broken though.

https://www.zen-cart.com/tutorials/index.php?article=292

I set download-by-redirect to False. I logged into my account and clicked the download button and I still don't get the pdf file.

The link I get when I click the download button is
http://www.mydomain.com/index.php?main_page=account_history_info&order_id=4

DrByte is the latest beta version almost ready for live sites?

Yesterday I deleted every file off my server and did a clean fresh upload of all the files and a new install and it hasn't made any difference to the download problem.

blue-grape:

Yesterday I deleted every file off my server and did a clean fresh upload of all the files and a new install and it hasn't made any difference to the download problem.
Looks very much like a server problem.
Have you tested other files, like maybe .zip ?

I moved the site to the server I have another Zen Cart running on.

After installing and making a purchase I had exactly the same problem. The only thing I could think that might be causing the problem was my zip of Zen Cart somehow had some corrupt files in it, so I downloaded a fresh zip of Zen Cart uploaded and installed in to the new server, did the install, made a test purchase and everything worked smoothly.

Thank you for your patience and help!