My users are also uploading large (300x300) avatars, even though the limit is set to 80x80. If this is related to server configuration as mentioned in this thread, does anyone know how to fix the problem?

I have php 4.1.2 on the server running XOOPS 2.0.7.3.

Thanks,
jim

I have a recent XOOPS install (2.0.7.3) that appears to be sending users multiple notifications of news items when an item is posted using the extended text feature. The news module shows as version 1.1. If a new item is created using the extended text, which flows the news to the second page, the users receive two "new news item" notifications in their email for the single item. Also, if an existing news item is edited to change the text from one page to two pages (i.e. moving some of the text down into the "extended text" box), users are receiving two notifications of a "new news item" even though no changes to the text have been made. My users are complaining about the email flood.

Is there a way to stop this without turning off news notifications? Is there something in the configuration of the news module or user notifications that I missed? I have set the news preferences "Enable specific events" for which the users can subscribe to only show the "Global: New Story" option. I have searched these forums for the problem and did not see a similar post so I assume it's a configuration issue and not a bug.

A related question: should users be receiving notifications of a "new story" if the text is edited, say to correct a typo? It appears that this may also be happening.

Thanks for your help.
jim

Samuels, thanks for the update. I have downloaded and tested the latest version, but I'm afraid the security problem still exists. If you know the file name, you can simply download the file without logging in to anything.

I have tried .htaccess but so far I can only turn off access to the uploads directory, which turns it off for registered XOOPS users as well so no one can download.

I believe some of the other php file management modules that I've seen use php rather http to download the files so they are not accessible without logging in to whatever php login mechanism is in place.

Thanks again for all your work. I will continue to look for something to fix this security problem.

jim

OK, I will try to poke through the scripts to see what maybe can be done with a hack.

Thanks again,
jim

Dave, thanks for the reply. Could you give me an example of where you would store the uploads directory and what permissions it should have to achieve the security, but still allow approved XOOPS group members to upload/download?

I feel like I am getting closer to having a working downloads environment, so thanks everyone for the help!

jim

Samuels,
I am trying to figure out the security "angle". Despite requiring logins and using group security and mime type limits, the uploads area seems very exposed. I have installed an index.php in the modules/mydownloads/uploads directory that redirects to the home page. However, if you know the file name it is a simple matter to download from the uploads directory.

Example would be a file called "salaries.doc" in uploads. If an employee is dismissed from the company, but knows the file link: "../modules/mydownloads/uploads/salaries.doc" he can download it even if his login is revoked.

Do you have any suggestions for implementing better security while continuing to allow file uploads from authorized group members?

Thanks again,
jim

Thanks, that worked!
I suppose I should have known about the "control key" selection process, but I had no clue.

Now I will try to really exercise the downloads module.

Many thanks for your work.

jim

Hi Samuels,
I have struggled mightly with this module and obviously I don't know what I'm doing, being new to Xoops. Following this thread and using common sense, I have removed the default downloads module and installed yours. I changed the upload location to "modules/mydownloads/uploads". I increased the max upload size. I checked "Allow user uploads".

The message I get no matter what file type I try to upload is "Mime type not allowed" - I've tried "txt", "gif", "jpg", "rtf" and a few others. Any idea what I've done wrong in the installation process?

Thanks,
jim

Addendum:
I just discovered that I can upload a file from the Admin page, but not from the "Submit" menu using either the Admin login or a registered user login. I still get the mime-type error.

Richard,
Thanks for the reply. I have downloaded the files from both references and am not entirely sure what to do with them. I was not able to find any documentation for either, but they appear to be replacements for the existing MyDownloads module.

I was not successful in installing either module, even though I renamed the existing modules/mydownloads directory. I received errors, an example is below, and then the Download module disappears from the Admin menu. I'm afraid I'm so new at this I need a step-by-step as to how to replace an existing XOOPS module, and then restore the original if it does not work.

I have had no difficulty installing other modules that I've tried, such as Xoopsgallery, but this is the first time I've tried to replace a module. I should add that I am using XOOPS 2.0.6.

Thanks again,
jim

Error when trying to "Update" MyDownloads module using MyDownloads_V:
Module File for mydownloads Not Found!Module File for mydownloads Not Found!Module File for mydownloads Not Found!Module data updated.
Rebuilding blocks...
Deleting module config options...
Config data deleted from the database. Config ID: 151
Config data deleted from the database. Config ID: 152
Config data deleted from the database. Config ID: 153
Config data deleted from the database. Config ID: 154
Config data deleted from the database. Config ID: 155
Config data deleted from the database. Config ID: 156
Config data deleted from the database. Config ID: 157
Config data deleted from the database. Config ID: 158
Config data deleted from the database. Config ID: 159
Config data deleted from the database. Config ID: 160
Config data deleted from the database. Config ID: 161
Config data deleted from the database. Config ID: 162
Config data deleted from the database. Config ID: 163

Module Downloads updated successfully.

Hi, am just starting out with XOOPS and am looking for a way to allow a group to upload files to the Downloads area. It appears that links to files can be submitted, but the files themselves are not actually uploaded by the user - is that correct or am I just confused? None of my users would have a server that would enable them to post a link for downloading, but they have files that need to be uploaded and shared in the downloads area.

I want to restrict the uploading of files (real files - not links) to a particular group. Is this possible?

I'm sure this is a nuisance newbie question but I searched the forum and googled and did not find what I need.

Thanks for any info,
jim