perfectweb

Manually refreshing rules solved the problem for me too. Thanks @viablethought!

No I did not contact Constant Contact plugin author. Are you not willing to look at this?

I have learned from my hosting company that zip files do not store permissions, so when they are expanded, files are in a neutral state and get assigned default permissions. For anyone else with this problem, the solution is simply to use the .tar.gz file format for your backups, because the .tar.gz files preserve permissions.

I took a look at the plugin’s WPPCP_Post_Attachments class (class-wppcp-post-attachments.php) and see how you are using the permissions to show or not show the download links, but are not using the permissions to control the download. A few extra lines in file_attachment_download() would prevent unauthorized downloads. See below.

i think users of your plugin are under the impression that managed file attachments are protected, and that someone could not post a link to the files that anyone else could use.

foreach ($post_attachments as $key => $attach_data) {
	if($attach_data['attach_id'] == $wppcp_file_id){
		// echo "<pre>";print_r($attach_data);exit;

		if ($this->verify_download_permission($attach_data)){
			$file_mime_type = isset($attach_data['mime']) ? $attach_data['mime'] : '';
			if($file_mime_type != ''){

				header('Cache-Control: public');
				header('Content-Description: File Transfer');
				header('Content-disposition: attachment;filename='.basename($file_dir));

				header('Content-Type: '. $file_mime_type);
				header('Content-Transfer-Encoding: binary');
				header('Content-Length: '. filesize($file_dir));
				readfile($file_dir);
				exit;
			}
		} else {
			echo 'You need to <a href="'.wp_login_url().'">login</a> before downloading this file.';
			exit();
		}
	}
}