Kunena 6.2.5 & module Kunena Latest 6.0.7 released

The Kunena team has announce the arrival of Kunena 6.2.5 [K 6.2.5] which is now available for download as a native Joomla extension for J! 4.3.x/4.4.x/5.0.x. This version addresses most of the issues that were discovered in K 6.1 / K 6.2 and issues discovered during the last development stages of K 6.2

Important [Unsolvable] How to secure files attached to posts in a forum only accessible for registered users?

More
14 years 1 month ago - 14 years 1 day ago #1 by Gompie
Hi,

I have installed Kunena in a closed section of my Joomla site to which only registered users have access.

I now notice that when those users attach files to posts, these files are accessible without registering once you know the name of the file, because the standard directory in which these attachments are stored by Kunena is not protected (/media/kunena/attachments/legacy/files/[name of the file]).

How can I solve this?

/Gompie
Last edit: 14 years 1 day ago by sozzled. Reason: Topic closed

Please Log in or Create an account to join the conversation.

More
14 years 1 month ago #2 by xillibit
Hello,

With a bit of search, you can find anything : www.kunena.com/forum/advsearch?q=hide+at...name=1&childforums=1

I don't provide support by PM, because this can be useful for someone else.

Please Log in or Create an account to join the conversation.

More
14 years 1 month ago - 14 years 1 month ago #3 by Gompie
Hi,

Ok, thanks (and sorry: must have used wrong search terms), but: I installed the 1.5.7 patch (I am still running the 1.5.7 version) and found the new configuration items in the backend (show images/attachement for guests = 'no'), but the files are still available; is this only valid for new posts or what?

/Gompie
Last edit: 14 years 1 month ago by Gompie.

Please Log in or Create an account to join the conversation.

More
14 years 1 month ago #4 by Gompie
Hi,

I have upgraded to 1.5.9 now, but it's still not working (using the 1.5.7. patch)...

Any ideas?

/Gompie

Please Log in or Create an account to join the conversation.

More
14 years 1 month ago #5 by Gompie
Hi

Installed the 1.5.8 patch now over the 1.5.9 and even tried the Dutch 1.5.9 Ultimate version as suggested, but still no solution (the Dutch 1.5.9 Ultimate version even gave an error in a language file after installing, apparently the uninstall doesn't really delete everything), but I guess those patches suit their purpose, but not mine: it all comes down to the fact that Kunena stores attachments to posts in a public Joomla directory /media/kunena/attachments/legacy/files and there's no way to change that ...

/Gompie

Please Log in or Create an account to join the conversation.

More
14 years 1 month ago #6 by Theo01
I haven't tried this myself yet because I never had any need for it, but here is what I think can work for you:

Prevent direct (hot) linking to files in your .htaccess file. This requires visitors to view the files inside the forum. You can apply this "trick" to other Joomla! components as well.

Lots of examples on how to configure an htaccess file contain a section for disabling hot linking.

That's the first one Google spits out: www.javascriptkit.com/howto/htaccess10.shtml

Please Log in or Create an account to join the conversation.

More
14 years 1 month ago #7 by Gompie
Hi,

Thanks, I already tried that, but that means that registered users, once inside the forum will have to use an extra login to get access to those files also and that's a bit annoying ...

/Gompie

Please Log in or Create an account to join the conversation.

More
14 years 1 month ago #8 by xillibit
Hello,

I don't undserstand where is the source of the issue, but you can try the changes that i have made for K1.5.9 :

File Attachment:

File Name: hide_attac...ests.zip
File Size:77 KB

I don't provide support by PM, because this can be useful for someone else.
Attachments:

Please Log in or Create an account to join the conversation.

More
14 years 1 month ago - 14 years 1 month ago #9 by Gompie
Hi,

Thanks, I upgraded, but the problem remains ...

The issue is this: www.cannedit.net/media/kunena/attachments/legacy/files/test.doc

I know: it only works in case you have the exact filename, but still ...

Kunena should in my opinion not store attachments in a subdirectory of a public Joomla directory and should at least offer in the configuration panel in the backend the opportunity to change the standard directory for storing attachments.

/Gompie
Last edit: 14 years 1 month ago by Gompie.

Please Log in or Create an account to join the conversation.

More
14 years 1 month ago #10 by xillibit
If, the user know the link he can download it, but i think there are no ways to prevent this.

I don't provide support by PM, because this can be useful for someone else.

Please Log in or Create an account to join the conversation.

Time to create page: 0.471 seconds