The best way is to use the shared files module so you can secure access to the files by role permissions. If the files were just uploaded to disk there could be no security because .NET isn't the handler for .doc, .xls, or .pdf files so anyone who knew the path could request those files and IIS would happily serve them up without giving .NET any opportunity to control access.

The Shared files module stores all files on disk using the .config extension which is handled by .NET and there fore allows protection. When downloading from the shared files module the code verifies the user has view permssion on th epage where the Shared Files module instance lives. If so it writes the file into the response changing it back to its original name and extension on the fly.

You could use the File Manager (Under Administration mneu) to upload files raw and then just link to them (using the new link browser), but only admins can use that feature because it allows direct access to the server file system.

Hope it helps,

Joe