So I'll start off by sayign that I'm new to DNN and then get straight into my current problem...

I have a site which in its simplest form has three user groups that will be able to download files off of teh site. Group A will be able to access File A, group B will be able to access file B and group C will be abel to access Files A and B.

I've set this upusing the Documents module shipped with DNN, I've got two modules on the page, one visible to A and C and one visible to B and C.

The files themselves are in secure directories on the file system (they have a padlock icon instead of the standard folder icon so defintiely secure). There is a directory for file A and a directory for file B. For permissions the one for file A has an explicit tick in the view column for A and a cross for B. Similarly for B.

The problem I have is that I can take the url for File A and if I paste it into my url bar when logged in as user B I get the file download successfully. I would have expected the folder level security to protect the files in that folder from being viewed as well.

Am I missing something here or is the folder security only for when viewing and uploading in the file manager? Are there any fixes for this? alternative modules that would do what I want?

Thanks very much for any help you can provide.

(Cross-posted from http://stackoverflow.com/questions/3311532/secure-file-downloads-in-dotnetnuke/ since I figured there is almost certainly a better base of experts on here)

Hmmm... That sounds like what I've done. Ah, and on further investigation I've finally got what my problem was. It appears that while testing I had uploaded the file a couple of times and of course I was referencing one of the earlier files I'd uploaded where I wasn't providing any security at all. I feel a little stupid now but on the other hand I am now 100% sure I understand how the security works, including the fact files are hidden from view if you don't have permission to write to them which is somethign I was after and didn't think I had! :)

Thanks for your time Cathal and sorry to have wasted it a bit. On the other hand I'd have not noticed my mistake if you hadn't posted so not entirely wasted I guess. :)