If you have this setting in your env.ini file:
disable_download_documents_session_validation = 1
Then, users don't have to login to download files.
You need to use this setting:
disable_download_documents_session_validation = 0
See: https://wiki.processmaker.com/3.2/Confi ... estriction
If you still have an active login session in the web browser, then the user can access the files. If you set this line in your env.ini
session_block = 1
Then, users will only be able to use ProcessMaker in one tab/window in the web browser.
See: https://wiki.processmaker.com/3.2/Confi ... _instances