I think we need to not use drupal_get_token() and drupal_valid_token() inside the functions file_entity_download_uri() and file_entity_download_page().

Probably something like the following:

function file_entity_get_download_token($file) {
  $identifier = !empty($GLOBALS['user']->uid) ? session_id() : ip_address();
  return drupal_hmac_base64("file/$file->fid/download", $identifier . drupal_get_private_key() . drupal_get_hash_salt());
}

And a converse of drupal_valid_token().

CommentFileSizeAuthor
#5 2062663-fix-the-token-on-callback-for-anonymous-users-5.patch1.64 KBKarlKedrovsky
#2 2062663-fix-the-token-on-callback-for-anonymous-users-2.patch1.73 KBKarlKedrovsky

Comments

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Issue tags: +7.x-2.0 beta blocker
KarlKedrovsky’s picture

KarlKedrovsky commented
Status: Active » Needs review
StatusFileSize
new 2062663-fix-the-token-on-callback-for-anonymous-users-2.patch1.73 KB

Attached is my first whack at the patch to implement this.

Status: Needs review » Needs work

The last submitted patch, 2062663-fix-the-token-on-callback-for-anonymous-users-2.patch, failed testing.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented 
+++ b/file_entity.pages.incundefined
@@ -37,7 +37,7 @@ function file_entity_view_page($file) {
+    if (!isset($_GET['token']) || !drupal_valid_token($_GET['token'], file_entity_get_download_token($file))) {
       return MENU_ACCESS_DENIED;

I think this will need to be changed to !isset($_GET['token']) || $_GET['token'] !== file_entity_get_download_token($file)

KarlKedrovsky’s picture

KarlKedrovsky commented
Status: Needs work » Needs review
StatusFileSize
new 2062663-fix-the-token-on-callback-for-anonymous-users-5.patch1.64 KB

OK, so I actually read the documentation for drupal_valid_token() this time which made it pretty obvious my original patch wasn't going to give us what we want. I made the update specified in #4 and worked just fine for me.

aaron’s picture

aaron commented
Status: Needs review » Reviewed & tested by the community

It works as advertised.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Reviewed & tested by the community » Fixed

Commmitted #5 to 7.x-2.x since it worked great! http://drupalcode.org/project/file_entity.git/commit/ca3f015

Automatically closed -- issue fixed for 2 weeks with no activity.