Error 403 attempting download release file

Look into your .htaccess configuration. Drupal 6's default .htaccess denies access to all .po files. Just remove that single item from the list of denied files (but not any of the other denied files, for your security).

Hi Gábor,

I think it would be useful if this is added to the documentation, if not done yet.

Have been struggling with this issue myself. And l10n_update is not really verbose on what went wrong while trying to grab updates.

I think this still applies to 7.x as well and we could add a simple .htaccess inside sites/default/files/l10n_packager that would allow .po files.
Something like

<FilesMatch "\.(po)$">
  Allow from ALL
</FilesMatch>

Would do the trick, what do you think?
maybe we could create this file in l10n_packager_create_path if the main directory (l10n_packager) doesn't exists?
I'm willing to create a patch for this if the maintainers agree with the solution :)

Cheers!

PS: Should I mark this as 7.x and then backport?

Something like this comes to mind (the patch is for 7.x but should be backportable)

but of course! the patch is for 7.x

#5: l10n_server-l10n_packager_create_htaccess_allow_file_download-1011532-6.patch queued for re-testing.

I think it's an upstream issue: #1763068: Allow .po downloads from Drupal except in the configured translations directory

This might be an upstream issue, but I just hit a very similar problem. http://drupal.org/node/1841730. It would be nice to have a fix at least for D7, if not D6, too.

It seems like #1763068: Allow .po downloads from Drupal except in the configured translations directory is not going to get fixed soon, if ever, since there's still some discussion on whether allowing people to download .po files is good or not.

In our case, we *want* users to be able to download translations (at least by default), so maybe a quick .htaccess file in the downloads folder is what we need.

I think .po files in l10n_server inside sites/default/files/l10n_packager are different from real module .po files and therefore, even if we might not want users to be able to download the .po files from installed modules, we want them to download the files generated by the packager.

Does that make sense?

Sounds like a good plan!

#5: l10n_server-l10n_packager_create_htaccess_allow_file_download-1011532-6.patch queued for re-testing.

I just played with this around and found that the server may not already send UTF-8 headers for .po files and added a force type, too. I fully support creating the .htaccess file in the packaging folder as this keeps the core .htaccess intact and this unprotects only the package folder and no others.

[.htaccess]

<FilesMatch "\.(po)$">
  ForceType 'text/plain; charset=utf-8'
  Allow from all
</FilesMatch>

I agree with committing #5 but is ForceType 'text/plain; charset=utf-8' required?

If there are cases where the server would send the wrong encoding for .po files, we might want to add it, but this might just be a missconfiguration of the server, @hass when/where did this happen?

Debian 6, on my server, when I reported it. This should be added for sure.

The patch works only if the /sites/default/files/l10n_packager folder is first deleted. Should add update functions.

re-generated the patch.

Committed, thanks a lot!