How QCLF Protects Forum Attachments

QCLF does not expose attachment bytes from a normal public upload directory. Attachment content is stored in the forum database and served through a QCLF download route that first rechecks the attachment and its parent forum content.

This keeps file access aligned with current Topic/Category visibility instead of treating a guessed file URL as authorization.

Database-Backed Storage

Each attachment receives a random storage key/stored name, metadata, SHA-256 hash, and a database BLOB containing the file bytes. The member-facing link uses the attachment record ID through the component’s raw download handler.

Permission-Aware Delivery

Before sending bytes, QCLF loads the non-deleted attachment, resolves its parent Topic or Message, and then uses the normal Topic/Category loaders. Those loaders require an approved, non-deleted Topic in a published/archived state and current Category/Section visibility/permissions.

For a reply attachment, the reply itself must still be an approved, non-deleted Message. If the parent cannot be resolved through those checks, QCLF returns the attachment as unavailable rather than sending the bytes.

Response Hardening

  • Images are sent inline; other supported files use attachment download disposition.
  • The filename is cleaned before being placed in Content-Disposition.
  • X-Content-Type-Options: nosniff is sent.
  • Caching is private with a one-hour max age.

What Soft Deletion Does

Soft deletion does not need to erase attachment rows immediately to make them inaccessible. A deleted Topic or Message fails the normal parent-content lookup, so its attachments stop being delivered.

When a deleted Topic is permanently purged, QCLF removes attachment rows associated with the Topic and its replies along with the other Topic-owned data.

Practical Result

Do not move attachment BLOBs into an unprotected web directory as a workaround. If an authorized member cannot download a file, troubleshoot the parent Topic/Message/Category visibility and attachment record rather than bypassing QCLF’s delivery route.

Community Discussion

Want to compare forum workflows, share practical QCLF tips, or discuss how other Joomla site owners use this feature? Visit the QC Live Forum Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.