[Trek]

At the top of the \downloads.php file where access permissions are set, it looks like a copy/paste problem with permissions.

All of the permissions are set to to the "canaddfiles" permission. So if someone can add files, they can do anything, delete, etc, view, etc.

To fix:

Open \downloads.php

Find:

$canaddfiles = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canaddfiles'];
$candeletefiles = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canaddfiles'];
$caneditfiles = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canaddfiles'];
$canaddimages = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canaddfiles'];
$canviewfiles = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canaddfiles'];
$canviewimages = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canaddfiles'];

Replace with:

$canaddfiles = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canaddfiles'];
$candeletefiles = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['candeletefiles'];
$caneditfiles = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['caneditfiles'];
$canaddimages = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canaddimages'];
$canviewfiles = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canviewfiles'];
$canviewimages = $permissions['bfc_download'] & $vbulletin->bf_ugp['bfc_download']['canviewimages'];