[cod] A word of advice

[Mavrick]

Yea spot on, just do not store your server configs in your http-redirect 
link!

set sv_allowdownload "1"
seta sv_wwwDownload "1"
seta sv_wwwBaseURL "http://yourdomain.com/path/to"
seta sv_wwwDlDisconnected "0"

You don't need the trailing slash on the end of the BaseURL.

the /path/to should take you to the base web folder containing the folders:

- mods
- usermaps

within the "mods" folder you have your mod folder setup as the same as 
the gameserver has except without the *.cfg files as the auto-redirect 
download for the mod should only download all *.iwd and *.ff files 
stored there. It isn't setup to download *.cfg or *.txt files. As far as 
I'm aware this cannot be exploited unless you store your config files on 
the web server. And as said previously disable directory browsing and 
direct access to *.cfg and *.txt files.

So just spit balling here, if your command line contained: +set fs_game 
mods/promodlive204, your web folder structure will be:

- mods
- - promodlive204
- - - mod.ff
- - - promodlive204.iwd
- - - z_custom_ruleset.iwd

And your game server folder structure would look like:

- mods
- - promodlive204
- - - mod.ff
- - - promodlive204.iwd
- - - server.cfg
- - - z_custom_ruleset.iwd

If you know your way around apache you can easily setup a .htaccess file 
to disable this or your web host can instruct you on how to do it via 
cPanel/Plesk web control panel.

Daniel "mavrick" Lang
www.mavrick.id.au