[AndrewD]

Originally Posted by ???`S?LV?R???`

but that wouldnt really protect the file, cause then people could just give out links still

The permissions system works in two ways, both building on VB's usergroups:

a) Ability to "do" certain things. You set this in the admin pages, by defining which usergroups can create links, categories, etc. Only a user who is a member of one of the specified groups can carry out the specified task.

b) Ability to "view" things. When you create/edit a link or category, you "assign" a forumid to the link/category. This may be explicit or implicit - i.e. if the user has can_set_permissions (see previous item), then that user can choose which forum to assign to the link, otherwise the default choice set by the administrator is used.

Whenever one of your users views these pages, she will only see links and categories for which her usergroup has the appropriate forum permission. I.e. if that group can see and visit a particular forum, then she can see and visit links associated with that forum.

This also works when trying to download a file. These are set up as a call to local_links.php?action=jump&id=n. If someone tries to get round the system by simply choosing a random number (or if someone tells someone else what number to enter), the code still checks to see if that usergroup has the relevant permission, and refuses the download if not. The user never gets to see where the actual file is stored.

Of course, if someone actually knows where the file is really stored, and gives out that information, then it is perfectly possible to bypass the whole security system. But that is nothing to do with this hack.

Clear?