How to download directly off product info page

Parafanaylya:

Sorry - the wife needed me.

That's okay, the bed needed me. :)

When I get back to my computer if either of the other two suggestions haven't resolved the issue I will post an .htaccess that might resolve the issue. Also might want to speak with your host about what's going on if there are no server logs for you to review that provide useful information. These are not the same error logs that ZC generates in the logs folder.

Maybe there is a setting on your application that is hiding hidden files?

.htaccess usable for download directory from ZC 1.5.4:

#
# @copyright Copyright 2003-2013 Zen Cart Development Team
# @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
# @version GIT: $Id: Author: DrByte  Fri May 17 14:29:18 2013 -0400 Modified in v1.5.2 $
#

AuthType Basic
AuthName "No access"
AuthUserFile .htnopasswd
AuthGroupFile /dev/null
#Require valid-user


###############################
#
# This is used with Apache WebServers
#
# The following blocks direct HTTP requests to all filetypes in this directory recursively, except certain approved exceptions
# It also prevents the ability of any scripts to run. No type of script, be it PHP, PERL or whatever, can normally be executed if ExecCGI is disabled.
# Will also prevent people from seeing what is in the dir. and any sub-directories
#
# For this to work, you must include either 'All' or at least: 'Limit' and 'Indexes' parameters to the AllowOverride configuration in your apache/conf/httpd.conf file.
# Additionally, if you want the added protection offered by the OPTIONS directive below, you'll need to add 'Options' to the AllowOverride list, if 'All' is not specified.
# Example:
#<Directory "/usr/local/apache/htdocs">
#  AllowOverride Limit Options Indexes
#</Directory>
###############################

# deny *everything*
<FilesMatch ".*">
  Order Allow,Deny
  Deny from all
</FilesMatch>

# but now allow just *certain* necessary files:
<FilesMatch "(?i).*\.(zip|gzip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|webm|m4v|m4a)$">
  Order Allow,Deny
  Allow from all
</FilesMatch>

<IfModule mod_headers.c>
  <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a)$">
    # tell all downloads to automatically be treated as "save as" instead of launching in an application directly
    # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below
    # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each):
    ForceType application/octet-stream
    Header set Content-Disposition attachment
  </FilesMatch>
</IfModule>

IndexIgnore */*


## NOTE: If you want even greater security to prevent hackers from running scripts in this folder, uncomment the following line (if your hosting company will allow you to use OPTIONS):
# OPTIONS -Indexes -ExecCGI

mc12345678:

Maybe there is a setting on your application that is hiding hidden files?

.htaccess usable for download directory from ZC 1.5.4:

I am not a coding person. What do I do with that code?

Parafanaylya:

I am not a coding person. What do I do with that code?

That is/was the contents of the .htaccess file that comes with ZC 1.5.4... Would create a file named .htaccess in the downloads directory then copy the contents from above into tht file.

Actually, considering that it seems your browser doesn't show .htaccess files (at least none so far) would suggest making any .php file then add the above contents, save the file, then rename t to .htaccess...

Would also suggest looking in your admin directory to see if there is an .htaccess file... There should be and if not, either it didn't get copied over or the current viewer. Is hiding hidden/system files (or both).

mc12345678:

That is/was the contents of the .htaccess file that comes with ZC 1.5.4... Would create a file named .htaccess in the downloads directory then copy the contents from above into tht file.

Actually, considering that it seems your browser doesn't show .htaccess files (at least none so far) would suggest making any .php file then add the above contents, save the file, then rename t to .htaccess...

Would also suggest looking in your admin directory to see if there is an .htaccess file... There should be and if not, either it didn't get copied over or the current viewer. Is hiding hidden/system files (or both).

Thanks. I copied the script to my Smultron text editor (running Mac), made the Syntax php, and saved as .htaccess. Now to try and reveal hidden files. Hello google my old friend:blush:

Now for the next trick.

It (safari)is hiding the .htaccess file. When trying to create the new file, it won't allow the creation as the file exists. Chrome?

Parafanaylya:

Now for the next trick.

It (safari)is hiding the .htaccess file. When trying to create the new file, it won't allow the creation as the file exists. Chrome?

Well, probably more of a setting related to that ftp/file editor. Not the browser...

I see it when using FileZilla
and this is what i get:

#
# @copyright Copyright 2003-2013 Zen Cart Development Team
# @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
# @version GIT: $Id: Author: DrByte  Fri May 17 14:29:18 2013 -0400 Modified in v1.5.2 $
#

AuthType Basic
AuthName "No access"
AuthUserFile .htnopasswd
AuthGroupFile /dev/null
#Require valid-user


###############################
#
# This is used with Apache WebServers
#
# The following blocks direct HTTP requests to all filetypes in this directory recursively, except certain approved exceptions
# It also prevents the ability of any scripts to run. No type of script, be it PHP, PERL or whatever, can normally be executed if ExecCGI is disabled.
# Will also prevent people from seeing what is in the dir. and any sub-directories
#
# For this to work, you must include either 'All' or at least: 'Limit' and 'Indexes' parameters to the AllowOverride configuration in your apache/conf/httpd.conf file.
# Additionally, if you want the added protection offered by the OPTIONS directive below, you'll need to add 'Options' to the AllowOverride list, if 'All' is not specified.
# Example:
#<Directory "/usr/local/apache/htdocs">
#  AllowOverride Limit Options Indexes
#</Directory>
###############################

# deny *everything*
<FilesMatch ".*">
  Order Allow,Deny
  Deny from all
</FilesMatch>

# but now allow just *certain* necessary files:
<FilesMatch "(?i).*\.(zip|gzip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|webm|m4v|m4a)$">
  Order Allow,Deny
  Allow from all
</FilesMatch>

<IfModule mod_headers.c>
  <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a)$">
    # tell all downloads to automatically be treated as "save as" instead of launching in an application directly
    # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below
    # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each):
    ForceType application/octet-stream
    Header set Content-Disposition attachment
  </FilesMatch>
</IfModule>

IndexIgnore */*


## NOTE: If you want even greater security to prevent hackers from running scripts in this folder, uncomment the following line (if your hosting company will allow you to use OPTIONS):
# OPTIONS -Indexes -ExecCGI

which at a glance appears to be correct

I see it when using FileZilla
and this is what i get:

#
# @copyright Copyright 2003-2013 Zen Cart Development Team
# @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
# @version GIT: $Id: Author: DrByte  Fri May 17 14:29:18 2013 -0400 Modified in v1.5.2 $
#

AuthType Basic
AuthName "No access"
AuthUserFile .htnopasswd
AuthGroupFile /dev/null
#Require valid-user


###############################
#
# This is used with Apache WebServers
#
# The following blocks direct HTTP requests to all filetypes in this directory recursively, except certain approved exceptions
# It also prevents the ability of any scripts to run. No type of script, be it PHP, PERL or whatever, can normally be executed if ExecCGI is disabled.
# Will also prevent people from seeing what is in the dir. and any sub-directories
#
# For this to work, you must include either 'All' or at least: 'Limit' and 'Indexes' parameters to the AllowOverride configuration in your apache/conf/httpd.conf file.
# Additionally, if you want the added protection offered by the OPTIONS directive below, you'll need to add 'Options' to the AllowOverride list, if 'All' is not specified.
# Example:
#<Directory "/usr/local/apache/htdocs">
#  AllowOverride Limit Options Indexes
#</Directory>
###############################

# deny *everything*
<FilesMatch ".*">
  Order Allow,Deny
  Deny from all
</FilesMatch>

# but now allow just *certain* necessary files:
<FilesMatch "(?i).*\.(zip|gzip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|webm|m4v|m4a)$">
  Order Allow,Deny
  Allow from all
</FilesMatch>

<IfModule mod_headers.c>
  <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a)$">
    # tell all downloads to automatically be treated as "save as" instead of launching in an application directly
    # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below
    # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each):
    ForceType application/octet-stream
    Header set Content-Disposition attachment
  </FilesMatch>
</IfModule>

IndexIgnore */*


## NOTE: If you want even greater security to prevent hackers from running scripts in this folder, uncomment the following line (if your hosting company will allow you to use OPTIONS):
# OPTIONS -Indexes -ExecCGI

which at a glance appears to be correct

I am in Johannesburg, South Africa, and have been up for about 1.5 hours.

It's Sunday, I am off to ride my MTB with buddies. And it's freezing cold

Thanks so far, be back in a few hours.

The day that kept me away from the PC. Back to work in the morning.

So it wasn't the .htaccess file.

I have tried the plugin, and it crashed my admin. Restored from backup to fix.

Parafanaylya:

So it wasn't the .htaccess file.

It may have been the file - the error log file that crashed the plugin referred to my old template name, no longer used. Any other ideas?

I have tried the plugin, and it crashed my admin. Restored from backup to fix.

Not sure about the plugin and the attempt to use an old template.

How big of a file is this that is being downloaded?
Is it possible to put one of the sample files in the download directory?
Have you tried replacing the contents of the .htaccess file ensuring to upload/transfer in ASCII mode?

The other thing to try (seeing that I was able to download a .txt file elsewhere on the site) is to modify the .htaccess file as follows:

Find:

<IfModule mod_headers.c>
  <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a)$">
    # tell all downloads to automatically be treated as "save as" instead of launching in an application directly
    # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below
    # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each):
    ForceType application/octet-stream
    Header set Content-Disposition attachment
  </FilesMatch>
</IfModule>

Modify by adding a # symbol as suggested in that text:

<IfModule mod_headers.c>
  <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a)$">
    # tell all downloads to automatically be treated as "save as" instead of launching in an application directly
    # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below
    # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each):
    # ForceType application/octet-stream
    # Header set Content-Disposition attachment
  </FilesMatch>
</IfModule>

mc12345678:

Not sure about the plugin and the attempt to use an old template.

How big of a file is this that is being downloaded?
Is it possible to put one of the sample files in the download directory?
Have you tried replacing the contents of the .htaccess file ensuring to upload/transfer in ASCII mode?

The other thing to try (seeing that I was able to download a .txt file elsewhere on the site) is to modify the .htaccess file as follows:

Find:

<IfModule mod_headers.c> <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a)$"> # tell all downloads to automatically be treated as "save as" instead of launching in an application directly # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each): ForceType application/octet-stream Header set Content-Disposition attachment </FilesMatch> </IfModule> ``` > > Modify by adding a # symbol as suggested in that text: > > ``` <IfModule mod_headers.c> <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a)$"> # tell all downloads to automatically be treated as "save as" instead of launching in an application directly # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each): # ForceType application/octet-stream # Header set Content-Disposition attachment </FilesMatch> </IfModule> ```

Thanks for this. The home directory backup is still running. Nearly 4 hours now. Stalling at 3.5gb. :frusty::frusty::frusty: another 0.4 to go. 4.8kbs on a 20mb vdsl fixed line. :no:

Then I'll have a go at your fix in the morning. Just got tucked into my very warm bed.

Some other "back to basics" things:
Verify filename capitalization (or in the sample case) small case letters only used for the entire filename, no spaces (use of underscore or hyphen is acceptable)
Now that you've found a way to see .htaccess files, verify that there s not some sort of rewriterule in the main directory's .htaccess (if it exists) associated with the download directory. Again, ZC doesn't provide a .htaccess file for the store root as ZC doesn't need one. I haven't seen anything yet that iindicates one is there, but...

Hopefully this post wasn't needed, but seeing the time differences, wanted to offer some food for thought in case.

Have tried the plugin, and it crashed my admin again. Busy with a (2-3 day) restore upload. Our ISP is pathetic, and was meant to be a top company. I could get my backup onto disc, DHL to States, restore on the server and be up & running quicker than uploading :(

Should have tried the #'s first damn

http://joburgonline.com/download/nsp0012_detail.pdf
This is showing "Internal Server Error" ... which is what Apache says when it encounters a security problem (and also when it encounters various other problems). It doesn't show the "actual" problem on-screen for security reasons (else hackers could learn info about your system to compromise it).
Instead, the "actual" error message is recorded in the server's Apache error_log. Your hosting company's control panel should give you access to the Apache error_log, but if it doesn't then contact your hosting company for specific help.
This really is a problem with your server configuration, and your hosting company should be able to resolve it in 30 seconds.

A temporary test would be to rename the /download/.htaccess file to .htaccess_OFF so that it is disabled and temporarily bypassed. If the files can be downloaded then your server has a conflict with the various permissions settings in that particular .htaccess file ... in which case you can work with your hosting company to determine the specific correct fix that will also give you the security protections that the original .htaccess file was designed to give you. Again, your hosting company will understand what's in the logs in relation to your symptoms and the actual error message and the contents of that .htaccess file.

DrByte:

http://joburgonline.com/download/nsp0012_detail.pdf
This is showing "Internal Server Error" ... which is what Apache says when it encounters a security problem (and also when it encounters various other problems). It doesn't show the "actual" problem on-screen for security reasons (else hackers could learn info about your system to compromise it).
Instead, the "actual" error message is recorded in the server's Apache error_log. Your hosting company's control panel should give you access to the Apache error_log, but if it doesn't then contact your hosting company for specific help.
This really is a problem with your server configuration, and your hosting company should be able to resolve it in 30 seconds.

A temporary test would be to rename the /download/.htaccess file to .htaccess_OFF so that it is disabled and temporarily bypassed. If the files can be downloaded then your server has a conflict with the various permissions settings in that particular .htaccess file ... in which case you can work with your hosting company to determine the specific correct fix that will also give you the security protections that the original .htaccess file was designed to give you. Again, your hosting company will understand what's in the logs in relation to your symptoms and the actual error message and the contents of that .htaccess file.

Very well explained for the layman, thanks..

I have tested the .htaccess_OFF rename. It now won't display the PDF, but we don't have a server issue any longer. So we are making progress. I remembered to revert the file name to its original .htaccess

I'll get hold of Merlin so he can do a paper trail on this thread.

mc12345678:

Not sure about the plugin and the attempt to use an old template.

How big of a file is this that is being downloaded?
Is it possible to put one of the sample files in the download directory?
Have you tried replacing the contents of the .htaccess file ensuring to upload/transfer in ASCII mode?

The other thing to try (seeing that I was able to download a .txt file elsewhere on the site) is to modify the .htaccess file as follows:

Find:

<IfModule mod_headers.c> <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a)$"> # tell all downloads to automatically be treated as "save as" instead of launching in an application directly # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each): ForceType application/octet-stream Header set Content-Disposition attachment </FilesMatch> </IfModule> ``` > > Modify by adding a # symbol as suggested in that text: > > ``` <IfModule mod_headers.c> <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a)$"> # tell all downloads to automatically be treated as "save as" instead of launching in an application directly # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each): # ForceType application/octet-stream # Header set Content-Disposition attachment </FilesMatch> </IfModule> ```

I have put the #'s in - no change

How would I upload in ASCII mode?