Hi Andre,

the files are not processed by the ASP.NET engine which is the reason why they are not secured by this mechanism.

If you would like to secure your files as well, you need to use the following:

1) Set up the folder for the files using the following web.config parameter:
<add key="CMSAttachmentsFolder" value="c:\attachments" />
The folder you specify must be outside your web space so that the files are not directly accessible from the web.

2) Use only the GetFile.aspx script to retrieve files and images. This script checks the secured areas and permissions so it will not provide the files to public users if they are part of some secured section.

Please let me if you need any additional information.

Best Regards,