Downloads and Security
Customer Documents serves local files through controlled download actions and redirects eligible external documents only after validation. Avoid linking directly to files in the media directory.
Local files
The configured upload path sits below pub/media. Allow only the file types the business needs and set a sensible upload-size limit. Web-server and PHP limits still apply.
Protect the upload folder from direct public browsing in the web-server configuration. A copied media URL should not bypass Customer Documents access checks.
External documents
External URLs are useful when files live in an approved document service. Configure Allowed External Domains with the exact trusted hostnames. An empty allowlist permits every domain, so it should not be used for a controlled production setup.
Only HTTP and HTTPS links should be used. The extension validates the external host before saving or redirecting.
Checks performed for a download
- customer or public access
- website scope
- validity dates
- password, when present
- download allowance
- local file availability or approved external destination
A failed check does not provide a valid file response. Successful downloads are recorded for reporting, and counters are updated only after an allowed response is prepared.
Download Report
Every recorded download appears under Customers > Customer Documents > Download Report with the document, customer, time and result. Use the grid to audit who downloaded a sensitive file. Its Delete mass action removes report rows — deleting a report row never touches the document itself.
Filenames
Enable Obscure Filename when customers should not receive the stored filename. This reduces accidental information exposure in downloaded filenames but does not replace access control.
Bulk downloads
ZIP downloads exclude password-protected and external documents. See ZIP Downloads.
For sensitive files, combine a private audience with a short validity period and, where appropriate, a password or download limit. Test the complete path using a customer account rather than only an administrator session.