"You do not have permission to download the requested file..." after update 4.1.4 to 4.1.7

[jeery2212]

Good evening,

Joomla site, version 5.4.8.

Following the site's compromise via the CVE-2026-61900 vulnerability, I found numerous files that had been dropped into the folder /www/administrator/components/com_jdownloads/test_uploads/ (by 3 different hackers on 3 different dates).

Following an alert from my hosting provider (OVH), I updated from version 4.1.4 to version 4.1.7, deleted the contents of the folders administrator/components/com_jdownloads/test_uploads/ and administrator/components/com_jdownloads/assets/upload/, and set up a .htaccess file to block access to these 2 directories.

However, since the update (currently on version 4.1.7), it is no longer possible to download files from the front end, either in public mode or authenticated mode. We consistently get this error message:

"You do not have permission to download the requested file.
Contact the website operator if you are sure that this is incorrect."

To work around the issue, I put the version 4.1.4 DownloadController.php file back into the directory: /www/components/com_jdownloads/src/Controller

What is the reason for this error message, and how can I fix it so that the 4.1.7 version of the DownloadController.php file works properly and allows me to have a secure site?

Problem like : https://www.jdownloads.com/forum/index.php?topic=15708.0

Anonymous access


Authentified access


thanks you

[ColinM]

Hi,
From what you say downloading from the backend is OK.  Is that OK for users other than the Superuser?
Sounds to me that user permissions might have become corrupted. Try with a new user,
ColinM

[jeery2212]

Hello,

I just tested with a newly created user, and the problem is identical, even when creating it without assigning any group permissions. An unauthenticated user encounters the same issue — no file can be downloaded from the front office.

Simply swapping back to the DownloadController.php file from version 4.1.4 in place of the 4.1.7 version makes it work again, but I lose the security measures that were put in place (plugin hook).

Thank you