Protect downloads

I have created a protected dir with Contao, files in this dir cannot be downloaded by entering the URL in the browser.

I have created a login form, after which visitors are redirected to a page with download links - using Contao download modules.

So far so good.

The problem: On another page I have included downloads (from another dir) but when I enter the protected file after the ?file= in the URL, I can download the protected files: test.html?file=tl_files/protected/protected_file.jpg

Shouldn't the ?file function take protected dirs into account? Is there any way to make this work?

Thx for your thoughts :)