download files being deleted

Lately a problem has arisen with a Zen Cart that has worked fine for years.

First the downloads stopped working and I noticed that the actual files had been deleted. I uploaded them again and tried a test order but I could still not access my download after the sale. So I disabled GZip compression and the downloads began functioning again.

However, my files are still getting deleted. I am having to re-upload them almost every day.

At first I suspected some kind of malware scanner was being run on the server and erroneously flagging our Ebooks and deleting them but the web hosts have looked into this extensively and they say this is not the case.

It seems very coincidental that I had to disable GZip to get the downloads working again, but now that it is disabled what could be causing the files to be deleted?

If you really are running 1.3.8a then outs highly likely you've been hacked. Any other strange behaviours?
You need to upgrade now once you've searched out any hacks/injections!!

picandnix:

If you really are running 1.3.8a then outs highly likely you've been hacked. Any other strange behaviours?
You need to upgrade now once you've searched out any hacks/injections!!

Nope, not been hacked.

I cannot upgrade this particular store for reasons that are not relevant to my question.

Just to add, if I put other files in the download folder that are not activated in attributes / download manager they will not be touched, only the actual active downloadable files get deleted. It is some kind of Zen Cart issue, perhaps dealing with GZip compression even though it is switched off in the admin area.

Just a quick update: I disabled the download via redirect function a few days ago and so far the files have not been deleted. 'Thought I would mention that in case it sheds any light on the source of the problem. (I'm not worried about customers knowing the path to the download folder because the ebooks still have to be unlocked with a PIN).

Out of interest how do you secure your books with a PIN please?

picandnix:

Out of interest how do you secure your books with a PIN please?

They are in an .exe format using EbookGold. It has worked OK for quite a few years now but is a bit restrictive (only useable on a PC running windows) and I'd like to port them over to a Kindle compatible format if we can retain enough security (the concern over piracy may be unfounded but I am not the author on these books so it's not my call).

djtrillian:

It is some kind of Zen Cart issue, perhaps dealing with GZip compression even though it is switched off in the admin area.
Um, no.

Zen Cart never deletes anything from the /download/ folder. Unless you've added code to do that.

When using download-by-redirect, the temporary-user-specific-download-symlink is placed in the /pub/ folder so they can do their download. That symlink is later removed as cleanup. But it never touches the original file in the /download/ folder, and thus never affects future downloads.

DrByte:

Um, no.

Zen Cart never deletes anything from the /download/ folder. Unless you've added code to do that.

When using download-by-redirect, the temporary-user-specific-download-symlink is placed in the /pub/ folder so they can do their download. That symlink is later removed as cleanup. But it never touches the original file in the /download/ folder, and thus never affects future downloads.

Um, well something is happening and I don't think it's an alien abduction. Now that the redirect function is turned off the files are not being deleted. As I said before, the keys points are; 1.Gzip compression was stopping all downloads from working. 2. Only the actual active download files were being deleted, other test files in the download folder were not touched. 3. Turning redirects off seems to have stopped the file deletion issue (so far).

I think something probably changed in the server environment because everything worked fine for years but I think it's too much of a coincidence for those factors, as mentioned above, to be unrelated.

The gzip issue was fixed between your 1.3.8 from 2006 and 1.5.0 from 2011, and tweaked even more in 1.5.1 from 2012.