{"action":"created","issue":{"url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/issues/4289","repository_url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads","labels_url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/issues/4289/labels{/name}","comments_url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/issues/4289/comments","events_url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/issues/4289/events","html_url":"https://github.com/easydigitaldownloads/Easy-Digital-Downloads/issues/4289","id":133273459,"number":4289,"title":"Token validation fails if edd_download_file_url_args has been filtered","user":{"login":"pippinsplugins","id":1034109,"avatar_url":"https://avatars.githubusercontent.com/u/1034109?v=3","gravatar_id":"","url":"https://api.github.com/users/pippinsplugins","html_url":"https://github.com/pippinsplugins","followers_url":"https://api.github.com/users/pippinsplugins/followers","following_url":"https://api.github.com/users/pippinsplugins/following{/other_user}","gists_url":"https://api.github.com/users/pippinsplugins/gists{/gist_id}","starred_url":"https://api.github.com/users/pippinsplugins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pippinsplugins/subscriptions","organizations_url":"https://api.github.com/users/pippinsplugins/orgs","repos_url":"https://api.github.com/users/pippinsplugins/repos","events_url":"https://api.github.com/users/pippinsplugins/events{/privacy}","received_events_url":"https://api.github.com/users/pippinsplugins/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/labels/Bug","name":"Bug","color":"fc2929"},{"url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/labels/Urgent","name":"Urgent","color":"FF0000"}],"state":"open","locked":false,"assignee":{"login":"pippinsplugins","id":1034109,"avatar_url":"https://avatars.githubusercontent.com/u/1034109?v=3","gravatar_id":"","url":"https://api.github.com/users/pippinsplugins","html_url":"https://github.com/pippinsplugins","followers_url":"https://api.github.com/users/pippinsplugins/followers","following_url":"https://api.github.com/users/pippinsplugins/following{/other_user}","gists_url":"https://api.github.com/users/pippinsplugins/gists{/gist_id}","starred_url":"https://api.github.com/users/pippinsplugins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pippinsplugins/subscriptions","organizations_url":"https://api.github.com/users/pippinsplugins/orgs","repos_url":"https://api.github.com/users/pippinsplugins/repos","events_url":"https://api.github.com/users/pippinsplugins/events{/privacy}","received_events_url":"https://api.github.com/users/pippinsplugins/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/milestones/121","html_url":"https://github.com/easydigitaldownloads/Easy-Digital-Downloads/milestones/2.5.8","labels_url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/milestones/121/labels","id":1503256,"number":121,"title":"2.5.8","description":"","creator":{"login":"pippinsplugins","id":1034109,"avatar_url":"https://avatars.githubusercontent.com/u/1034109?v=3","gravatar_id":"","url":"https://api.github.com/users/pippinsplugins","html_url":"https://github.com/pippinsplugins","followers_url":"https://api.github.com/users/pippinsplugins/followers","following_url":"https://api.github.com/users/pippinsplugins/following{/other_user}","gists_url":"https://api.github.com/users/pippinsplugins/gists{/gist_id}","starred_url":"https://api.github.com/users/pippinsplugins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pippinsplugins/subscriptions","organizations_url":"https://api.github.com/users/pippinsplugins/orgs","repos_url":"https://api.github.com/users/pippinsplugins/repos","events_url":"https://api.github.com/users/pippinsplugins/events{/privacy}","received_events_url":"https://api.github.com/users/pippinsplugins/received_events","type":"User","site_admin":false},"open_issues":49,"closed_issues":0,"state":"open","created_at":"2016-01-12T21:33:53Z","updated_at":"2016-02-12T15:47:36Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2016-02-12T15:47:36Z","updated_at":"2016-02-12T15:58:03Z","closed_at":null,"body":"In #3981 we added improved token validation so that URLs that were manipulated after they were generated (for campaign variables as an example) did not invalidate.\r\n\r\nUnfortunately this has caused an unforeseen side effect.\r\n\r\nIf the `edd_download_file_url_args` filter has been used to register custom arguments to the download link, customers are presented with a permission denied error when attempting to download the file. This happens because the token validation fails.\r\n\r\nWe know for sure that the PDF Vouchers extension is affected by this. There could be others.\r\n\r\nAt the very top of `edd_validate_url_token()`, the passed in URL looks like this:\r\n\r\n```\r\nhttps://edd.com/basic?eddfile=3633:2102:0:0&ttl=1455389978&edd_voucher=1&file=edd_vou_pdf&token=c9fbfef5c577dca1e6d14955250d5f59\r\n```\r\n\r\nAfter we remove all non-whitelisted arguments, it looks like this:\r\n\r\n```\r\nhttps://edd.com/basic?eddfile=3633:2102:0:0&ttl=1455389978&file=edd_vou_pdf&token=c9fbfef5c577dca1e6d14955250d5f59\r\n````\r\n\r\nWhen we regenerate the token from the URL using `edd_get_download_token( $url )`, the resulting token is `2a21b71a72d9314e136233df01bbe027`, which does not match the token from the URLs above, `c9fbfef5c577dca1e6d14955250d5f59`.\r\n\r\nTo resolve this, we will need to programmatically detect any custom arguments that have been registered with `edd_download_file_url_args`."},"comment":{"url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/issues/comments/183385263","html_url":"https://github.com/easydigitaldownloads/Easy-Digital-Downloads/issues/4289#issuecomment-183385263","issue_url":"https://api.github.com/repos/easydigitaldownloads/Easy-Digital-Downloads/issues/4289","id":183385263,"user":{"login":"pippinsplugins","id":1034109,"avatar_url":"https://avatars.githubusercontent.com/u/1034109?v=3","gravatar_id":"","url":"https://api.github.com/users/pippinsplugins","html_url":"https://github.com/pippinsplugins","followers_url":"https://api.github.com/users/pippinsplugins/followers","following_url":"https://api.github.com/users/pippinsplugins/following{/other_user}","gists_url":"https://api.github.com/users/pippinsplugins/gists{/gist_id}","starred_url":"https://api.github.com/users/pippinsplugins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pippinsplugins/subscriptions","organizations_url":"https://api.github.com/users/pippinsplugins/orgs","repos_url":"https://api.github.com/users/pippinsplugins/repos","events_url":"https://api.github.com/users/pippinsplugins/events{/privacy}","received_events_url":"https://api.github.com/users/pippinsplugins/received_events","type":"User","site_admin":false},"created_at":"2016-02-12T15:58:03Z","updated_at":"2016-02-12T15:58:03Z","body":"The easy way to fix this is to force extensions to register their customer URL variables with the `edd_url_token_allowed_params` filter, but that goes against our philosophy of not introducing breaking changes. We should be able to automatically detect custom parameters."}}