Attachments - attempt to download a document fails due to permissions Topic is solved

[DorsetJoomla]

I have three sites that use the Attachments extension and have done so for years. I have been informed that on one of them any attempt to download an document (could be PDF or .docx) results in the message

Forbidden
You don't have permission to access this resource.

I don't know how long this has been going on but I am on the latest version of Attachments 3.2.6 and Joomla 3.9.28, PHP 7.4.20
I have checked all of the permissions are set to public access as on the other sites and even if I go in into the backend and look at the documents as a superuser I still can't download them. Any suggestions welcome.

I would reinstall but presumably I would lose access to the existing document set and there seems to be little support for this extension by the original writer.

Thanks

[Webdongle]

https://forumpostassistant.github.io/docs/ please

[DorsetJoomla]

error

[Webdongle]

Please explain

[Per Yngve Berg]

I suspect the culprit is a Security Option is set to strict on your server.

[DorsetJoomla]

Joomla! Instance :: Joomla! 3.9.28-Stable (Amani) 6-July-2021
Joomla! Platform :: Joomla Platform 13.1.0-Stable (Curiosity) 24-Apr-2013
Joomla! Configured :: Yes | Writable (644) |
Configuration Options :: Offline: false | SEF: true | SEF Suffix: false | SEF ReWrite: false | .htaccess/web.config: Yes | GZip: true | Cache: true | CacheTime: 13 | CacheHandler: file | CachePlatformPrefix: false | FTP Layer: false | Proxy: false | LiveSite: | Session lifetime: 2800 | Session handler: database | Shared sessions: N/A | SSL: 0 | Error Reporting: default | Site Debug: false | Language Debug: false | Default Access: 1 | Unicode Slugs: false | dbConnection Type: mysqli | PHP Supports J! 3.9.28: Yes | Database Supports J! 3.9.28: Yes | Database Credentials Present: Yes |

Host Configuration :: OS: Linux | OS Version: 3.10.0-1160.21.1.el7.x86_64 | Technology: x86_64 | Web Server: Apache | Encoding: gzip, deflate | System TMP Writable: Yes | Free Disk Space : 3831.24 GiB |

PHP Configuration :: Version: 7.4.20 | PHP API: cgi-fcgi | Session Path Writable: No | Display Errors: | Error Reporting: 22519 | Log Errors To: | Last Known Error: | Register Globals: | Magic Quotes: | Safe Mode: | Allow url fopen: | Open Base: | Uploads: 1 | Max. Upload Size: 128M | Max. POST Size: 128M | Max. Input Time: 120 | Max. Execution Time: 120 | Memory Limit: 128M

Database Configuration :: Version: 5.5.62-log (Client:mysqlnd 7.4.20) | Database Size: 13.21 MiB | #of Tables with config prefix:  117 | #of other Tables:  0 | User Privileges : GRANT SELECTUser Privileges : INSERTUser Privileges : UPDATEUser Privileges : DELETEUser Privileges : CREATEUser Privileges : DROPUser Privileges : INDEXUser Privileges : ALTERUser Privileges : CREATE TEMPORARY TABLESUser Privileges : LOCK TABLES ON `westlul`.* TO 'westlul'@'192.168.%'

PHP Extensions :: Core (7.4.20) | date (7.4.20) | libxml (7.4.20) | openssl (7.4.20) | pcre (7.4.20) | sqlite3 (7.4.20) | zlib (7.4.20) | bcmath (7.4.20) | bz2 (7.4.20) | calendar (7.4.20) | ctype (7.4.20) | curl (7.4.20) | dba (7.4.20) | dom (20031129) | enchant (7.4.20) | hash (7.4.20) | fileinfo (7.4.20) | filter (7.4.20) | ftp (7.4.20) | gd (7.4.20) | gettext (7.4.20) | gmp (7.4.20) | SPL (7.4.20) | iconv (7.4.20) | session (7.4.20) | intl (7.4.20) | json (7.4.20) | ldap (7.4.20) | mbstring (7.4.20) | standard (7.4.20) | mysqlnd (mysqlnd 7.4.20) | odbc (7.4.20) | pcntl (7.4.20) | mysqli (7.4.20) | PDO (7.4.20) | pdo_dblib (7.4.20) | pdo_mysql (7.4.20) | PDO_ODBC (7.4.20) | pdo_pgsql (7.4.20) | pdo_sqlite (7.4.20) | pgsql (7.4.20) | Phar (7.4.20) | posix (7.4.20) | pspell (7.4.20) | readline (7.4.20) | Reflection (7.4.20) | imap (7.4.20) | shmop (7.4.20) | SimpleXML (7.4.20) | snmp (7.4.20) | soap (7.4.20) | sockets (7.4.20) | exif (7.4.20) | sysvmsg (7.4.20) | sysvsem (7.4.20) | sysvshm (7.4.20) | tidy (7.4.20) | tokenizer (7.4.20) | xml (7.4.20) | xmlreader (7.4.20) | xmlrpc (7.4.20) | xmlwriter (7.4.20) | xsl (7.4.20) | zip (1.15.6) | cgi-fcgi (7.4.20) | ionCube Loader (10.4.5) | Zend Engine (3.4.0) |
Potential Missing Extensions ::
Disabled Functions :: syslog | openlog | highlight_file | show_source | proc_nice | posix_kill | posix_mkfifo | posix_mknod | posix_setegid | posix_seteuid | posix_setpgid | posix_setsid | posix_setuid | posix_setgid | pfsockopen | pcntl_setpriority |

Switch User Environment :: PHP CGI: Yes | Server SU: Yes | PHP SU: Yes | Potential Ownership Issues: No

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) | administrator/logs/ (---) |

Elevated Permissions (First 10) :: administrator/cache/_system/ (775) | administrator/cache/com_languages/ (775) | administrator/cache/com_modules/ (775) | administrator/cache/fof/ (775) | cache/_system/ (775) | cache/com_content/ (775) | cache/com_languages/ (775) | cache/com_menus/ (775) | cache/com_modules/ (775) | cache/com_templates/ (775) |

Database statistics :: Uptime: 37670910 | Threads: 15 | Questions: 47230578768 | Slow queries: 2458 | Opens: 514916551 | Flush tables: 1 | Open tables: 10240 | Queries per second avg: 1253.767 |

Components :: Site ::
Core :: com_mailto (3.0.0) 1 | com_wrapper (3.0.0) 1 |
3rd Party:: WF_AGGREGATOR_DAILYMOTION_TITLE (2.6.6) ? | WF_AGGREGATOR_VIMEO_TITLE (2.6.6) ? | WF_AGGREGATOR_VINE_TITLE (2.6.6) ? | WF_AGGREGATOR_[youtube]_TITLE (2.6.6) ? | WF_FILESYSTEM_JOOMLA_TITLE (2.6.6) ? | WF_LINKS_JOOMLALINKS_TITLE (2.6.6) ? | WF_POPUPS_JCEMEDIABOX_TITLE (2.6.6) ? | WF_POPUPS_WINDOW_TITLE (2.6.6) ? | WF_LINK_SEARCH_TITLE (2.6.6) ? | WF_ANCHOR_TITLE (2.6.6) ? | WF_ARTICLE_TITLE (2.6.6) ? | WF_AUTOSAVE_TITLE (2.6.6) ? | WF_BROWSER_TITLE (2.6.6) ? | WF_CHARMAP_TITLE (2.6.6) ? | WF_CLEANUP_TITLE (2.6.6) ? | WF_CLIPBOARD_TITLE (2.6.6) ? | WF_CONTEXTMENU_TITLE (2.6.6) ? | WF_DIRECTIONALITY_TITLE (2.6.6) ? | WF_FONTCOLOR_TITLE (2.6.6) ? | WF_FONTSELECT_TITLE (2.6.6) ? | WF_FONTSIZESELECT_TITLE (2.6.6) ? | WF_FORMATSELECT_TITLE (2.6.6) ? | WF_FULLSCREEN_TITLE (2.6.6) ? | WF_IMGMANAGER_TITLE (2.6.6) ? | WF_INLINEPOPUPS_TITLE (2.6.6) ? | WF_KITCHENSINK_TITLE (2.6.6) ? | WF_LAYER_TITLE (2.6.6) ? | WF_LINK_TITLE (2.6.6) ? | WF_LISTS_TITLE (2.6.6) ? | WF_MEDIA_TITLE (2.6.6) ? | WF_NONBREAKING_TITLE (2.6.6) ? | WF_PREVIEW_TITLE (2.6.6) ? | WF_PRINT_TITLE (2.6.6) ? | WF_SEARCHREPLACE_TITLE (2.6.6) ? | WF_SOURCE_TITLE (2.6.6) ? | WF_SPELLCHECKER_TITLE (2.6.6) ? | WF_STYLE_TITLE (2.6.6) ? | WF_STYLESELECT_TITLE (2.6.6) ? | WF_TABLE_TITLE (2.6.6) ? | WF_TEXTCASE_TITLE (2.6.6) ? | WF_VISUALBLOCKS_TITLE (2.6.6) ? | WF_VISUALCHARS_TITLE (2.6.6) ? | WF_XHTMLXTRAS_TITLE (2.6.6) ? | WF_HR_TITLE (2.6.6) ? | WF_EMOTIONS_TITLE (2.6.6) ? |

Components :: Admin ::
Core :: com_admin (3.0.0) 1 | com_ajax (3.2.0) 1 | com_banners (3.0.0) 1 | com_cache (3.0.0) 1 | com_categories (3.0.0) 1 | com_checkin (3.0.0) 1 | com_config (3.0.0) 1 | com_content (3.0.0) 1 | com_contenthistory (3.2.0) 1 | com_cpanel (3.0.0) 1 | com_finder (3.0.0) 1 | com_installer (3.0.0) 1 | com_joomlaupdate (3.6.2) 1 | com_languages (3.0.0) 1 | com_login (3.0.0) 1 | com_media (3.0.0) 1 | com_menus (3.0.0) 1 | com_messages (3.0.0) 1 | com_modules (3.0.0) 1 | com_newsfeeds (3.0.0) 1 | com_plugins (3.0.0) 1 | com_postinstall (3.2.0) 1 | com_redirect (3.0.0) 1 | com_search (3.0.0) 1 | com_tags (3.1.0) 1 | com_templates (3.0.0) 1 | com_users (3.0.0) 1 | com_associations (3.7.0) 1 | com_fields (3.7.0) 1 | com_actionlogs (3.9.0) 1 | com_privacy (3.9.0) 1 |
3rd Party:: com_attachments (3.2.6) 1 | Akeeba (8.0.8) 1 | com_jaextmanager (2.5.3) 0 | com_jaextmanager (2.6.6) 0 | COM_JCE (2.6.6) 1 | Admintools (6.1.0) 1 | Quick Logout (1.9.3) 1 | com_sitemapgenerator (1.4.0) 1 | COM_OSMAP (4.3.2) 1 | Smart Slider 3 (3.5.0.10) 1 |

Modules :: Site ::
Core :: mod_articles_archive (3.0.0) 1 | mod_articles_categories (3.0.0) 1 | mod_articles_category (3.0.0) 1 | mod_articles_latest (3.0.0) 1 | mod_articles_news (3.0.0) 1 | mod_articles_popular (3.0.0) 1 | mod_banners (3.0.0) 1 | mod_breadcrumbs (3.0.0) 1 | mod_custom (3.0.0) 1 | mod_feed (3.0.0) 1 | mod_finder (3.0.0) 1 | mod_footer (3.0.0) 1 | mod_languages (3.5.0) 1 | mod_login (3.0.0) 1 | mod_menu (3.0.0) 1 | mod_random_image (3.0.0) 1 | mod_related_items (3.0.0) 1 | mod_search (3.0.0) 1 | mod_stats (3.0.0) 1 | mod_syndicate (3.0.0) 1 | mod_tags_popular (3.1.0) 1 | mod_tags_similar (3.1.0) 1 | mod_users_latest (3.0.0) 1 | mod_whosonline (3.0.0) 1 | mod_wrapper (3.0.0) 1 |
3rd Party:: Simple Image Holder (3.0.2) 1 | ARI Image Slider (2.1.13) 1 | ARI Image Slider (2.1.13) 1 | Smart Slider 3 Module (3.5.0.10) 1 | JS Like Box Slider (6.8.96) 1 |

Modules :: Admin ::
Core :: mod_custom (3.0.0) 1 | mod_feed (3.0.0) 1 | mod_latest (3.0.0) 1 | mod_logged (3.0.0) 1 | mod_login (3.0.0) 1 | mod_menu (3.0.0) 1 | mod_multilangstatus (3.0.0) 1 | mod_popular (3.0.0) 1 | mod_quickicon (3.0.0) 1 | mod_stats_admin (3.0.0) 1 | mod_status (3.0.0) 1 | mod_submenu (3.0.0) 1 | mod_title (3.0.0) 1 | mod_toolbar (3.0.0) 1 | mod_version (3.0.0) 1 | mod_sampledata (3.8.0) 1 | mod_privacy_dashboard (3.9.0) 1 | mod_latestactions (3.9.0) 1 |
3rd Party:: MOD_CACHECLEANER (7.5.0) 1 | Reset Hits module (3.3.0) 1 |

Libraries ::
Core ::
3rd Party:: file_fof30 (3.6.2) ? | Regular Labs Library (21.7.10061) 1 | file_fof40 (4.0.0) ? |

Plugins ::
Core :: plg_authentication_cookie (3.0.0) 1 | plg_authentication_gmail (3.0.0) 0 | plg_authentication_joomla (3.0.0) 1 | plg_authentication_ldap (3.0.0) 0 | plg_captcha_recaptcha (3.4.0) 0 | plg_captcha_recaptcha_invisible (3.8) 0 | plg_content_emailcloak (3.0.0) 1 | plg_content_finder (3.0.0) 0 | plg_content_joomla (3.0.0) 1 | plg_content_loadmodule (3.0.0) 1 | plg_content_pagebreak (3.0.0) 1 | plg_content_pagenavigation (3.0.0) 1 | plg_content_vote (3.0.0) 1 | plg_content_fields (3.7.0) 1 | plg_content_confirmconsent (3.9.0) 0 | plg_editors-xtd_article (3.0.0) 1 | plg_editors-xtd_image (3.0.0) 1 | plg_editors-xtd_pagebreak (3.0.0) 1 | plg_editors-xtd_readmore (3.0.0) 1 | plg_editors-xtd_module (3.5.0) 1 | plg_editors-xtd_fields (3.7.0) 1 | plg_editors-xtd_menu (3.7.0) 1 | plg_extension_joomla (3.0.0) 1 | plg_finder_categories (3.0.0) 1 | plg_finder_contacts (3.0.0) 1 | plg_finder_content (3.0.0) 1 | plg_finder_newsfeeds (3.0.0) 1 | plg_finder_tags (3.0.0) 1 | plg_quickicon_extensionupdate (3.0.0) 1 | plg_quickicon_joomlaupdate (3.0.0) 1 | plg_quickicon_phpversioncheck (3.7.0) 1 | plg_quickicon_privacycheck (3.9.0) 1 | plg_search_categories (3.0.0) 1 | plg_search_contacts (3.0.0) 1 | plg_search_content (3.0.0) 1 | plg_search_newsfeeds (3.0.0) 1 | plg_search_tags (3.0.0) 1 | plg_system_cache (3.0.0) 0 | plg_system_debug (3.0.0) 1 | plg_system_highlight (3.0.0) 1 | plg_system_languagecode (3.0.0) 0 | plg_system_languagefilter (3.0.0) 0 | plg_system_log (3.0.0) 1 | plg_system_logout (3.0.0) 1 | plg_system_p3p (3.0.0) 0 | plg_system_redirect (3.0.0) 0 | plg_system_remember (3.0.0) 1 | plg_system_sef (3.0.0) 1 | plg_system_sessiongc (3.8.6) 1 | JA Typo (2.5.8) 0 | plg_system_stats (3.5.0) 1 | plg_system_updatenotification (3.5.0) 1 | plg_system_fields (3.7.0) 1 | plg_system_logrotation (3.9.0) 1 | plg_system_privacyconsent (3.9.0) 0 | PLG_SYSTEM_ACTIONLOGS (3.9.0) 0 | plg_twofactorauth_totp (3.2.0) 0 | plg_twofactorauth_yubikey (3.2.0) 0 | plg_user_contactcreator (3.0.0) 0 | plg_user_joomla (3.0.0) 1 | plg_user_profile (3.0.0) 0 | plg_user_terms (3.9.0) 0 | plg_installer_webinstaller (2.1.2) 1 | PLG_INSTALLER_FOLDERINSTALLER (3.6.0) 1 | plg_installer_packageinstaller (3.6.0) 1 | PLG_INSTALLER_URLINSTALLER (3.6.0) 1 | plg_fields_calendar (3.7.0) 1 | plg_fields_checkboxes (3.7.0) 1 | plg_fields_color (3.7.0) 1 | plg_fields_editor (3.7.0) 1 | plg_fields_imagelist (3.7.0) 1 | plg_fields_integer (3.7.0) 1 | plg_fields_list (3.7.0) 1 | plg_fields_media (3.7.0) 1 | plg_fields_radio (3.7.0) 1 | plg_fields_sql (3.7.0) 1 | plg_fields_text (3.7.0) 1 | plg_fields_textarea (3.7.0) 1 | plg_fields_url (3.7.0) 1 | plg_fields_user (3.7.0) 1 | plg_fields_usergrouplist (3.7.0) 1 | plg_fields_repeatable (3.9.0) 1 | plg_privacy_consents (3.9.0) 1 | plg_privacy_content (3.9.0) 1 | plg_privacy_message (3.9.0) 1 | plg_privacy_user (3.9.0) 1 | plg_privacy_actionlogs (3.9.0) 1 | PLG_ACTIONLOG_JOOMLA (3.9.0) 1 |
3rd Party:: plg_content_attachments (3.2.6) 1 | pdf_embed (2.1) 1 | Simple Picture Slideshow (1.5.8) 1 | Content - Simple Pop-Up (2.1) 1 | plg_content_jce (2.6.6) 1 | plg_editors_codemirror (5.60.0) 1 | plg_editors_tinymce (4.5.12) 0 | plg_editors_jce (2.6.6) 1 | plg_editors-xtd_add_attachment_btn (3.2.6) 1 | plg_editors-xtd_insert_attachments_ (3.2.6) ? | Editor Button - JA Typo Button (2.5.9) 0 | pdf_btn (2.1) 1 | plg_extension_jce (2.6.6) 1 | plg_quickicon_attachments (3.2.6) 1 | plg_quickicon_akeebabackup (8.0.8) 1 | plg_quickicon_jce (2.6.0-pro-bet) 1 | plg_search_attachments (3.2.6) 1 | Lg offline page (2.2.0) 0 | plg_system_show_attachments_in_edit (3.2.6) ? | T3 Framework (2.7.7) 1 | plg_system_jsntplframework (2.3.6) 0 | plg_system_jce (2.6.6) 1 | System - JCE MediaBox (1.2.9) 1 | PLG_SYSTEM_BACKUPONUPDATE (8.0.8) 1 | PLG_SYSTEM_ADMINTOOLS (6.1.0) 1 | PLG_SYSTEM_REGULARLABS (21.7.10061) 1 | PLG_SYSTEM_CACHECLEANER (7.5.0) 1 | PLG_SYSTEM_AKGEOIP (1.0.6) 1 | plg_system_ossystem (1.3.1) 1 | JS Facebook Likebox Slider (6.2.5) ? | Smart Slider 3 System Plugin (3.5.0.10) 1 | plg_attachments_plugin_framework (3.2.6) 1 | plg_attachments_for_content (3.2.6) 1 | plg_installer_jce (2.6.6) 1 | PLG_INSTALLER_ADMINTOOLS (6.1.0) 1 | Smart Slider 3 Updater Plugin (3.5.0.10) 1 | PLG_ACTIONLOG_AKEEBABACKUP (8.0.8) 0 | PLG_ACTIONLOG_ADMINTOOLS (6.1.0) 0 | PLG_OSMAP_JOOMLA (4.3.2) 1 |

Templates :: Site :: beez3 (3.1.0) ? | protostar (1.0) 1 | purity_III (1.2.5) 1 |
Templates :: Admin :: hathor (3.0.0) 1 | isis (1.0) 1 |

[Per Yngve Berg]

Session Path Writable: No

Sessions must be Writable.

[Webdongle]

Folders should be 755
files (except configuration.php) should be 644
configuration.php should be 444 (save global config and see if it changes configuration.php to 444

[DorsetJoomla]

Session Path Writable: No

Sessions must be Writable.

Thanks but where do I find Session Path?

[Per Yngve Berg]

For a shared host, contact your host.

For a VPS you manage, it's in php.ini

[DorsetJoomla]

Finally solved it. Admin Tools needed have /attachments added for direct access. I can't understand why it wasn't there already as it used to be. Perhaps it was overwritten during an update.
Anyway thanks for your help and if nothing else I have learned about using the fpa system too.

Regards