Thanks, seemed easy enough. So I added the extra field and inserted the following link
<a href="files/instructions/23100.pdf">PDF Instructions</a>
and the results I got when I click on the link is:
Forbidden
You don't have permission to access /xcart/files/instructions/23100.pdf on this server.
I've obviously missed something. I've got XC running locally on a WAMP server setup. Suggestions?