Understand Protected Plan Resource Download Security

Understand QCMM protected Plan Resource downloads: authenticated ownership, access rules, safe same-site files, remote-host validation, redirect limits, and forced attachment delivery.

Download Requests Are Re-authorized

A protected Plan Resource download requires a logged-in Joomla user, a valid subscription ID owned by that user, and a Download-type Resource attached to that subscription's Plan. A Resource whose access rule is not all additionally requires the subscription to count as active.

Same-Site Files Stay Inside Joomla's Root

For same-site paths, QCMM resolves the physical file under JPATH_ROOT and refuses path escape. Dotfiles, configuration files, and executable/source extensions such as PHP are not served through the direct-file shortcut; those URLs fall back to normal HTTP handling instead of exposing source from disk.

Remote Downloads Are SSRF-Restricted

Remote URLs must use HTTP or HTTPS, cannot contain URL credentials, and must resolve to allowed hosts. Non-site hosts are rejected when DNS resolves to private or reserved IP space. Every redirect target is validated again, so a public URL cannot simply redirect QCMM into a private network target.

Redirect and Transport Limits

QCMM follows remote redirects itself rather than enabling unrestricted automatic redirects, with a maximum of five redirects before failure. Remote retrieval uses bounded connection/overall timeouts and treats non-2xx final responses as download errors.

QCMM Forces Attachment Delivery

The file is streamed through QCMM with Content-Disposition: attachment, private/no-store cache headers, and X-Content-Type-Options: nosniff. The original remote URL does not need to be exposed to the customer's browser, preventing Plan Resources from becoming an unrestricted fetch proxy.

Community Discussion

Want to compare QCMM workflows or share practical tips? Visit the QC Memberships & Meetings Community. For private support, bug reports, account-specific entitlement or billing problems, or feature requests, use the QuantaCade support system.