I've no idea what you mean by "ambiguous text added".
I think you and your host are completely misunderstanding the simple process that Zen Cart is trying to do here.
If your store is set to the default configuration of "Download By Redirect" being enabled, then this is what happens:
a) customer purchases the files
b) customer visits the download links (presented on order-completion screen and/or their my-account order history screen)
c) customer clicks the download link
d) then in the /pub/ folder ZC creates a new folder using a randomly-generated foldername prefixed with a dot
e) ZC looks up the name of the file associated with their purchase and finds the file in the /download/ folder and reads its filesize
f) it instructs PHP to request that the filesystem create a symlink in that /pub/.randomfoldername/ folder which points to the actual file from the /download/ folder (a symlink is like a "shortcut" or "alias" to the original, and NOT an actual copy of the file, since there's no need to make copies when symlinks will serve the purpose perfectly fine as long as symlinking is enabled on your server)
g) then it sends a "filesize and filename" header followed by a "location redirect" header to the browser to take the customer directly to that symlinked file and start a download. This makes the browser talk to Apache directly to obtain the file from the filesystem, without involving Zen Cart in any of the actual download of the file contents.
So, as I've said previously, if your account isn't permitting ZC to create the hidden folder in the /pub/ directory, or isn't being allowed to generate symlinks, or isn't being allowed to follow symlinks, then the downloads won't work. Zen Cart does try to detect whether the symlink was successfully generated and if it can't find the symlink after attempting to create it, normally will fallback to one of the other available methods: either direct-download from the /download/ folder (VERY insecure because the filename link can be shared with "friends" who will never have to pay for those downloads), or the download-by-streaming method which sends the file's contents directly instead of using the symlink/redirect. This latter approach is much more server-intensive and is a less desirable method but may be the only viable option in some server configurations. However it will not generate a 403-forbidden error because the permission to access the page is already granted since the file is being served from a PHP script.
If you are are not using Apache, then you will have to sort out with your hosting company how their webserver engine works instead of traditional configurations of webserver activity.
Also as has been discussed here, if there are characters in the filenames which make for complicated serving as URLs or paths in an HTML or browser request, then things could get interrupted. There will be no errors recorded about this failure because it's very difficult to detect this situation programmatically.
Further, as also mentioned, if the filename doesn't match a pattern that has been whitelisted in the /pub/.htaccess rules then the server's security will block the browser's request for the file. This will be recorded in the server's webserver errorlogs because the webserver is enforcing that rule.
I'm not sure why I'm having to write this here again, as much of this is already explained in the various FAQ articles talking about download delivery methods (which shows the "how it works" and "what each method does and why") and about relocating download folders for added security precautions (that is an advanced concept that may not work for all server configurations). Those articles are worth the read, especially when you're having problems such as you are purporting.
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.
