Search the Community

Hi, when I create a customer group I then have to enable it for all the existing categories, is there a massive way to do it? Thanks for any reply. Balla

I have created a couple of categories that I do not want to be visible to anyone unless they are logged in and in a special group I have created and added them to manually. I created the groups and in "Group access" I unchecked Visitor, Guest and regular Customer and checked my custom group. I tested this by logging out and trying to go to the individual product page and category page and I got the error saying I did not have access, so it was working properly. However when I copied the url link (eg. http://www.mysite.com/index.php?controller=attachment&id_attachment=4) to one of the attachments to a product I was able to get to it without being logged in. With a little more investigation it seems we can easily change the "id_attachment" variable and gain access to all attachments regardless of access permissions. Checking the attachment controller I found it had no security checks at all. This is a problem for me as it is the attachments my client does not want to be accessible to the public. I am wondering if there is an update where security is added here or perhaps a module which has proper attachment security.