[squidsk]

That only partially solves the problem in that it doesn't give them a listing of what's in the directory, but if they know the exact file name on the server they can still access it without going through the downloadII interface. The only way around it is to make the directory where the files are stored not in the your web root.

For example on the server I administer the web root is /var/www/, but the files are stored in /var/local/userfiles/downloads/, so there's no way for those files to ever be accessed except through the downloadsII interface.