Problem with user download don't need complete profile.

[hackinOS]

Hello. I need only registered user can download file with Profile Complete.

But i have lInk for attatchment https://hackinos.com/applications/core/interface/file/attachment.php?id=99&key=45baec852110b9207431920ab2ec39d1. User can download if they don't have fill all the complete field on the proflie complete.

Is this the error the Core of IPS? Can't fix this, right? 

[Jim M]

Could you please elaborate further? How is that link obtained? Do you have "Prevent direct linking?" enabled?

[hackinOS]

When u click a website with a link. Example i have: https://hackinos.com/applications/core/interface/file/attachment.php?id=99&key=45baec852110b9207431920ab2ec39d1, it's showing like this

I must have register for link, and i'm also copy direct link above ( https://hackinos.com/applications/core/interface/file/attachment.php?id=99&key=45baec852110b9207431920ab2ec39d1 )

I'm register with new account 

Here, don't need to complete profile, just paste direct link and it can be download

[Marc]

That would be correct if they have a link for it, with a key like that. There is no way around that. However I would say, they cannot get that link unless someone provides it to them

[hackinOS]

17 hours ago, Marc Stridgen said:

That would be correct if they have a link for it, with a key like that. There is no way around that. However I would say, they cannot get that link unless someone provides it to them

Don't need anyone provides a link, just click on the attatchment and copy that link, after regiters and waiting profile complete, just paste a link, bump, get a file don't need profile complete.

Edited December 21, 2021 by hackinOS

[Marc]

Sorry, Im really not sure what you mean here. Please provide a step by step as to what is happening here. You stated it doesnt need anyone to provide a link, however in your example thats exactly what would be needed as otherwise they would not have a link to click

[Nathan Explosion]

Marc - when a non-image/video file is attached to a forum post, for example, the resulting link to download that file is as follows:

https://invisioncommunity.com/applications/core/interface/file/attachment.php?id=172895&key=0844d6818e424750811e43111d3be144

When someone clicks that link, the attachment.php file determines if they have permissions to download the file, which is based on group permissions. The "must have completed the profile" element here is irrelevant, and I believe the original poster would like it to be taken into account.

If you want to stop newbies from downloading files then don't allow them permissions to do so.

file.txt

[Marc]

2 hours ago, Nathan Explosion said:

Marc - when a non-image/video file is attached to a forum post, for example, the resulting link to download that file is as follows:

https://invisioncommunity.com/applications/core/interface/file/attachment.php?id=172895&key=0844d6818e424750811e43111d3be144 33 B · 1 download

When someone clicks that link, the attachment.php file determines if they have permissions to download the file, which is based on group permissions. The "must have completed the profile" element here is irrelevant, and I believe the original poster would like it to be taken into account.

If you want to stop newbies from downloading files then don't allow them permissions to do so.

file.txt 33 B · 1 download

Ah I see. Thank you for that.

Indeed that is correct. Its certainly not something we would take into account, and as mentioned, they would not actually have the link for an attachment unless they are provided it, as if they have to fill in their profile they would not be able to get to where that attachment is