Unauthorized access to Downloads to any Registered Users, except Super Users

[jpierre]

Hello,

I got this message ('Unauthorized access to Downloads') from my users trying to download from my website after clicking on Download links.
Note that :
- Super Users can download
- These downloads were 'functional' before, probably before an update to Joomla 5 and jdownloads 4.1.

I am now using :
- Joomla 5.4.5
- Jdownloads 4.1.3
- on My server : PHP 8.2.30 / DataBase 10.4.22-MariaDB-1:10.4.22+maria~stretch-log

What i did try to check  :
- permissions : All my downloads are marked as permission 'Inherited' for Download, and in the back End --> Allowed (Inherited) green mark is shown (All users inherits from Registered and Registered are Allowed for download)
- Options : Following some posts here in the forum, i tried to switch security options (Protect your download Directory, Activate Hotlinking Protection, Block when no Referrer) without any effect on my issue. My standard config is :
  o Protect your download Directory YES
  o Activate Hotlinking Protection  YES
  o Block when no Referrer NO
- I saw in the forum some probable issue using Google CAPTCHA, and then try to change the USER GROUP SETTINGS. This shows me an error : 1364 Field 'form_fieldset' doesn't have a default value

Would you have any other suggestion to try ?

[EDIT]
if it can help
- it seems that as long as the user inherit from Registered --> download Unauthorized despite what is displayed
- if i create a new User Group, outside Regisitered --> the download is operational, but the user cannot log in (access must be restricted by login and cannot be public)

Thanks in advance,

[jpierre]

Hello Again,

Not sure it is related to my problem but this is the call stack for the 1364 error i got on user group settings

Call Stack
#   Function   Location
1   ()   JROOT/libraries/vendor/joomla/database/src/Mysqli/MysqliStatement.php:411
2   Joomla\Database\Mysqli\MysqliStatement->execute()   JROOT/libraries/vendor/joomla/database/src/DatabaseDriver.php:651
3   Joomla\Database\DatabaseDriver->execute()   JROOT/administrator/components/com_jdownloads/src/Model/GroupsModel.php:200
4   JDownloads\Component\JDownloads\Administrator\Model\GroupsModel->getItems()   JROOT/libraries/src/MVC/View/AbstractView.php:171
5   Joomla\CMS\MVC\View\AbstractView->get()   JROOT/administrator/components/com_jdownloads/src/View/Groups/HtmlView.php:49
6   JDownloads\Component\JDownloads\Administrator\View\Groups\HtmlView->display()   JROOT/libraries/src/MVC/Controller/BaseController.php:697
7   Joomla\CMS\MVC\Controller\BaseController->display()   JROOT/administrator/components/com_jdownloads/src/Controller/DisplayController.php:50
8   JDownloads\Component\JDownloads\Administrator\Controller\DisplayController->display()   JROOT/libraries/src/MVC/Controller/BaseController.php:730
9   Joomla\CMS\MVC\Controller\BaseController->execute()   JROOT/libraries/src/Dispatcher/ComponentDispatcher.php:143
10   Joomla\CMS\Dispatcher\ComponentDispatcher->dispatch()   JROOT/libraries/src/Component/ComponentHelper.php:361
11   Joomla\CMS\Component\ComponentHelper::renderComponent()   JROOT/libraries/src/Application/AdministratorApplication.php:150
12   Joomla\CMS\Application\AdministratorApplication->dispatch()   JROOT/libraries/src/Application/AdministratorApplication.php:206
13   Joomla\CMS\Application\AdministratorApplication->doExecute()   JROOT/libraries/src/Application/CMSApplication.php:304
14   Joomla\CMS\Application\CMSApplication->execute()   JROOT/administrator/includes/app.php:58
15   require_once()   JROOT/administrator/index.php:32
Previous Error

Field 'form_fieldset' doesn't have a default value

Call Stack
#   Function   Location
1   ()   JROOT/libraries/vendor/joomla/database/src/Mysqli/MysqliStatement.php:407
2   mysqli_stmt->execute()   JROOT/libraries/vendor/joomla/database/src/Mysqli/MysqliStatement.php:407
3   Joomla\Database\Mysqli\MysqliStatement->execute()   JROOT/libraries/vendor/joomla/database/src/DatabaseDriver.php:651
4   Joomla\Database\DatabaseDriver->execute()   JROOT/administrator/components/com_jdownloads/src/Model/GroupsModel.php:200
5   JDownloads\Component\JDownloads\Administrator\Model\GroupsModel->getItems()   JROOT/libraries/src/MVC/View/AbstractView.php:171
6   Joomla\CMS\MVC\View\AbstractView->get()   JROOT/administrator/components/com_jdownloads/src/View/Groups/HtmlView.php:49
7   JDownloads\Component\JDownloads\Administrator\View\Groups\HtmlView->display()   JROOT/libraries/src/MVC/Controller/BaseController.php:697
8   Joomla\CMS\MVC\Controller\BaseController->display()   JROOT/administrator/components/com_jdownloads/src/Controller/DisplayController.php:50
9   JDownloads\Component\JDownloads\Administrator\Controller\DisplayController->display()   JROOT/libraries/src/MVC/Controller/BaseController.php:730
10   Joomla\CMS\MVC\Controller\BaseController->execute()   JROOT/libraries/src/Dispatcher/ComponentDispatcher.php:143
11   Joomla\CMS\Dispatcher\ComponentDispatcher->dispatch()   JROOT/libraries/src/Component/ComponentHelper.php:361
12   Joomla\CMS\Component\ComponentHelper::renderComponent()   JROOT/libraries/src/Application/AdministratorApplication.php:150
13   Joomla\CMS\Application\AdministratorApplication->dispatch()   JROOT/libraries/src/Application/AdministratorApplication.php:206
14   Joomla\CMS\Application\AdministratorApplication->doExecute()   JROOT/libraries/src/Application/CMSApplication.php:304
15   Joomla\CMS\Application\CMSApplication->execute()   JROOT/administrator/includes/app.php:58
16   require_once()   JROOT/administrator/index.php:32

[Arno]

Hello,
thank you for the detailed report and excuse my late reply.

The SQL error

1364 Field 'form_fieldset' doesn't have a default value

is a real bug on our side. I have already fixed it for the next update. It happens when jDownloads auto-creates missing rows in the user group limits table.

Important: this field is only used for the inquiry/survey form settings. It is not the permission field for normal downloads.

So at the moment I assume the SQL error and the "Unauthorized access to Downloads" problem are related symptoms of an inconsistent group/ACL setup, but not exactly the same bug.

The SQL part is fixed already.
For the download authorization issue I am still checking the ACL / asset path for inherited Registered permissions.

Thank you for the report.

[Arno]

Hi,
to track down the download access problem, I need a little more information from your installation.

Please check or send:

1. Which exact Joomla user group is affected?
Registered only, or also Author / Editor / other groups?

2. Does the problem affect all downloads, or only some categories / downloads?

3. Please post screenshots of:
- the affected jDownloads user group settings
- the permissions of one affected category
- the permissions of one affected download

4. Please test one simple case:
- one user only in Registered
- one download in one category
- category permission = Inherited
- download permission = Inherited

5. If possible, please also tell me whether anything changes after:
- Joomla Database Fix
- jDownloads asset / permission repair tools

This should help me determine whether the problem comes from group settings, inherited ACL rules, or broken asset links.

Thank you.

[jpierre]

Hi Arno,

Thanks a lot for your reply.

Here are the infos i got :

1. Which exact Joomla user group is affected?

Any Group (or direct User) inheriting from Registered, if those Users / Groups are moved to a 'new Registered' group with standard settings, all downloads become functional again.
This is by the way what i did as a workaround :
- create a new 'Registered_BCK' group with sign in access at the same level than 'Registered'
- move all my sub groups from Registered to Registered_BCK
- change any access level using Registered to Registered_BCK
- and all is accessible again, like it was for the other native groups like Super Users ...
- Note that any of my permissions are Inherited.

2. Does the problem affect all downloads, or only some categories / downloads?

Yes the problem affect all downloads. They are still visible according to ACL, user can click on Download and then get an Unauthorized message (see below for screenshots 20250504_TestDownloadFrontEnd_2.png).

3. Please post screenshots of:

- the affected jDownloads user group settings : --> Not accessible, see 20250504_UserGroupSettings_KO.png
- the permissions of one affected category : --> 20250504_Category_Permissions.png, all Inherited
- the permissions of one affected download: --> 20250504_Download_Permissions.png, all Inherited

4. Please test one simple case:

see the following process :
- user creation --> 20250504_Test_User_Creation.png
- ACL Creation --> 20250504_ACL_Creation.png
- Category Creation --> 20250504_Category_Creation.png
- Category Permission --> 20250504_Category_Permissions.png
- Download Creation --> 20250504_Download_Creation.png
- Download Permission --> 20250504_Download_Permissions.png
And the test from Front End :
- Accessing the download --> 20250504_TestDownloadFrontEnd_1.png
- after clicking on download -- >20250504_TestDownloadFrontEnd_2.png

5. If possible, please also tell me whether anything changes after:

We did indeed those action from jdownloads Tools menu:
- Check DataBase Table
- Reset Permissions
But not yet the Database Fix from Joomla.

I joined as well the Update log so that you wan see what process has been followed up.
(In PM to be able to join the files)

Pierre

[Arno]

Hi Pierre,
thanks again for all the testing and for the screenshots.

At this point I think we can narrow it down a bit more:

The problem does not seem to be the access level itself.
It looks more like something is wrong in the original Registered user group branch on your site.

The main clue is this:
users and groups connected to the existing Registered branch cannot download,
but when those same users/groups are moved under a newly created Registered-style group, the downloads work again.

I also made a first comparison test on the 4.1.3 demo site with the same basic setup, and there the download works normally.
So at the moment I cannot reproduce this as a general jDownloads 4.1.3 bug.

You can test the same frontend case directly here:
https://jd40.jdownloads.org
Login: TestUser
Password: TestUser

Then open this test category:
https://jd40.jdownloads.org/downloads/category/86-test_debug_category.html

With that test user, the category access and the download should work.

As a next step on your own site, I would also recommend running Joomla Database Fix once and then repeating exactly the same test again with the original Registered branch.

Note:
With the login above you can check the frontend test case directly.
If you want to compare the backend setup as well, just let me know again. That is no problem.

That means the current indication is:
this is more likely a site-specific ACL / inheritance issue in the original Registered group path on your installation, not a general problem with the Registered access level itself.

That said, I do not want to leave it there.
If you want, I can still help you narrow it down further on your site.

If the same test still fails afterwards, we can check the Joomla ACL / asset data for the test category and test download more closely.

So for now, the workaround with the new Registered-style group seems valid, but I would still like to understand what is different in the old Registered branch on your installation.

Even if the Registered group seems to work normally elsewhere in Joomla, this can still be limited to how ACL inheritance affects the jDownloads category/download assets on this installation.

[jpierre]

Hi Arno,

Thanks for your detailed feedback, and i understand your analysis.
I can btw confirm that anything is working well from your Demo site, and that it's something on my environment then.

I will check the Database Fix and let you know. (Unfortunately not before the start of Next Week as i need to leave for a business trip). This is indeed the first thing to test.

Even if this is not related, do yo know if there could be an easy fix to apply to bypass the Field 'form_fieldset' doesn't have a default value problem ? I'd like to access the User Group Settings panel and check if something may be visible there ?

In anycase, I will update here any new information / solution as soon as i can work again on that subject.

Best Regards,

[Arno]

Hi Pierre,
the SQL issue in the User Group Settings is already fixed in the current development state.
I will send you a prerelease package (via PM) so you can test that part directly.

This fix is for the known database error in the User Group Settings.
It may or may not affect the separate download / Registered issue, so it would be helpful if you test both again afterwards.

Thanks.