Download bug

[dfdssfsfd3806]

hello I found a bug in the download if I copy a download link for a premium account I little run directly from another pc another ip without even his return to me why his page normally it will have refused Download

 

[dfdssfsfd3806]

Even without token can be downloaded directly without going through the download page

 

[dfdssfsfd3806]

look [removed]

 

[joymax27104000]

Thanks for reporting,
this is big bug, I hope admin will fix it asap

 

[dfdssfsfd3806]

Now I understand why my sales account is dropped

 

[ollie]

The download token should only last 24 hours anyway

 

[dfdssfsfd3806]

yes ben not need token without its works

 

[ysmods]

The file edit is NOT guaranteed to work, however it did stop the immediate downloading of files without a token on my dev site.

Open /includes/class.file.php

Find:

// remove session
if (isset($_SESSION['showDownload']))
{
	$clearSession = true;

	// fixes android snag which requests files twice
	if (deviceIsAndroid())
	{
		if (!isset($_SESSION['showDownloadFirstRun']))
		{
			$_SESSION['showDownloadFirstRun'] = true;
			$clearSession                     = false;
		}
		else
		{
			$_SESSION['showDownloadFirstRun'] = null;
			unset($_SESSION['showDownloadFirstRun']);
		}
	}

	if ($clearSession == true)
	{
		// reset session variable for next time
		$_SESSION['showDownload'] = null;
		unset($_SESSION['showDownload']);
		session_write_close();
	}
}

REPLACE WITH:

// remove session
if (isset($_SESSION['showDownload']))
{
	$clearSession = true;

	// fixes android snag which requests files twice
	if (deviceIsAndroid())
	{
		if (!isset($_SESSION['showDownloadFirstRun']))
		{
			$_SESSION['showDownloadFirstRun'] = true;
			$clearSession                     = false;
		}
		else
		{
			$_SESSION['showDownloadFirstRun'] = null;
			unset($_SESSION['showDownloadFirstRun']);
		}
	}

	if ($clearSession == true)
	{
		// reset session variable for next time
		$_SESSION['showDownload'] = null;
		unset($_SESSION['showDownload']);
		session_write_close();
	}
}
if(!$downloadToken || empty($downloadToken))
{
	output404();
}

 

[dfdssfsfd3806]

thank you can already corrected but I can copy the link to a page and download the same link type instead of sharing the link to the person see the pub

 

[ysmods]

Have to wait on Adam to release a bug fix

 

[dfdssfsfd3806]

yes thank you

 

[dfdssfsfd3806]

normally if not the same ip should return to the download page for the free use voi the pub otherwise unprofitable

 

[adam]

Morning all,

This has been patched to the latest release code and will be documented for the v4.0 release. To manually patch, open:

includes/class.file.php

Find: (around line 51)

if ($downloadToken != null)

Replace with:

if ($downloadToken !== null)

(note the extra equals)

As usual, drop me an email if you need any help

Thanks,
Adam.

 

[dfdssfsfd3806]

ok look i can download
[removed]

Can I download directly to this thread without even going through the pub page on my website
Version 4 will fix this?
when it comes out because I think this major flaw since I found many site providing direct links

 

[adam]

That's correct. It's a download token which is valid for 24 hours. So you can reuse it. If you search in includes/class.file.php for:

$tokenData =

You'll see the commented out line to restrict by IP. Feel free to use. We've had some issues as people often change their IPs while downloading a large file. Your other option it to reduce how long the tokens last.

There's no plans to change this for v4.

 

[dfdssfsfd3806]

but the link good and yesterday when I put the post
[removed]

in the database if I click on the link it generates a token in the token download page and download tracker

 

[adam]

This is a different issue. Can you raise a support ticket please and list in detail the problem.

 

[dfdssfsfd3806]

ok

 

[dfdssfsfd3806]

here I send your email with youtube video

 

[dfdssfsfd3806]

if I put her

<?php echo $file->generateDirectDownloadUrlForMedia(); ?>

is good but the free user download unlimited speed

if iput her

 '.$file->getFullShortUrl(true).'?df=1&dt='.$embedToken.'

limit its non-premium members, but it will keep the link active all the time so the problem I