Forbidden error 403 when downloading

Thought I had the downloads working--it's showing up in the download manager, customer can order, cart says it's available for download but when you click on Download Now, you get an error 403. Both the download directory and the file itself are set to 0755.

I see what part of the problem is--zencart is looking for it in the 'pub' directory rather than the download directory. But I moved the file to the pub directory and I still get the 403 Forbidden error message.

Here is the url that's being generated. I have no idea where the subdirectory name after pub is coming from.

http://www.newnaturalsonline.com/pub/.dnhmwolaxhpecoubtin-1480968219/golden_paste_directions.pdf

Zen Cart offers multiple styles of serving downloads.

It "could" do the old-school way of just making every file downloadable from whatever place you actually upload it ... and then all your customers can share that link with their friends so nobody else has to "buy" it anymore. But most storeowners aren't in the business of giving all their paid downloads away for free.

So, the default method is to serve downloads "by redirect", which causes the server to:

• wait for order to be paid
• when the download link is clicked, it makes a new temporary folder the /pub/ directory with a random name starting with "." (because dot-prefixed files/folders are generally treated as "hidden" by most operating systems)
• then it makes a symlink to your product's download file into that temporary folder
• then that is what serves the file when the customer clicks the link
  --- and before actually serving the file it checks whether the link has been used more than the allowed number of times you configured when you set it up in the Attributes Controller ... and if they've downloaded it too many times it denies access.

Another method is to download by "chunking" ... which is useful for extra-large files if the redirect method is having memory problems on the server. Same approach is used for authorizing the download, but the symlink is bypassed.

Possible causes of your problem:

• server doesn't support symlinks. This is rare nowadays, as most reliable servers support symlinks now. It's usually old servers that can't handle this.
  -- the symlink issue could be a PHP version limitation (windows servers are still catching up)
  -- the symlink issue could be an apache rule configuration that's preventing symmlinks from being honored, even though Zen Cart comes with an .htaccess file that tells it to honor symlinks (could be master apache config overriding it)
• your PHP and/or filesystem configuration might be disallowing files to be created under the pub folder (permissions issue)

Alterates:

• Try changing to download-by-streaming/chunking (Admin Configuration Attributes)
• Or, if neither of those more secure methods work, you could set downloads to go Direct ... but then you have no security or authorization control.

Several FAQs address the subject. Here's one: Download delivery methods explained

One other possible cause or variation on one of the above, the symlink that is created to redirect to the download file is provided the wrong access rights (0777 by default ZC in includes/modules/pages/download/header_php.php instead of 0755).

It's something I often have to change on the more "public" servers.

Thanks, both of you. I didn't know about symlinks. I did manually change the directory and file permissions, but I'll go back with this info and do some more checking. The product is free and the number of accesses is set to some ridiculously high number, so neither of those should be an issue.

I fixed it for the time being by changing the settings to streaming. This is a smallish file and it's free, so I don't need some of the restrictions provided by the redirect. I'll have to figure this out at some future time when we start charging for another planned download, but for the moment, the problem is solved. Thanks for your help.