Hi. I'm getting into DNN and really enjoying how easy it is to use and configure so far.

My question has to do with restricting access to files that are uploaded. If Bob knows what the link is for such-and-such a file isto see it, but doesn't actually have the rights to the download page, he can still type in the link into the browser and have the document download. (So, yeah, we're bypassing the entire Documents module.) I realize it's secure if Bob doesn't know the address, but security by obscurity isn't optimal here.

I'm figuring I'm going to have to get down at a lower level and use some web.config files to set access levels for these directories - has anyone already solved this problem and can they give me a hand with implementing it?

Thanks!
John