{"action":"closed","issue":{"url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/3286","repository_url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads","labels_url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/3286/labels{/name}","comments_url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/3286/comments","events_url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/issues/3286/events","html_url":"https://github.com/easydigitaldownloads/easy-digital-downloads/issues/3286","id":63025727,"number":3286,"title":"File path not properly discovered on multisite when attachment_id is missing","user":{"login":"pippinsplugins","id":1034109,"avatar_url":"https://avatars.githubusercontent.com/u/1034109?v=3","gravatar_id":"","url":"https://api.github.com/users/pippinsplugins","html_url":"https://github.com/pippinsplugins","followers_url":"https://api.github.com/users/pippinsplugins/followers","following_url":"https://api.github.com/users/pippinsplugins/following{/other_user}","gists_url":"https://api.github.com/users/pippinsplugins/gists{/gist_id}","starred_url":"https://api.github.com/users/pippinsplugins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pippinsplugins/subscriptions","organizations_url":"https://api.github.com/users/pippinsplugins/orgs","repos_url":"https://api.github.com/users/pippinsplugins/repos","events_url":"https://api.github.com/users/pippinsplugins/events{/privacy}","received_events_url":"https://api.github.com/users/pippinsplugins/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/easydigitaldownloads/easy-digital-downloads/labels/Bug","name":"Bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"cklosowski","id":1390124,"avatar_url":"https://avatars.githubusercontent.com/u/1390124?v=3","gravatar_id":"","url":"https://api.github.com/users/cklosowski","html_url":"https://github.com/cklosowski","followers_url":"https://api.github.com/users/cklosowski/followers","following_url":"https://api.github.com/users/cklosowski/following{/other_user}","gists_url":"https://api.github.com/users/cklosowski/gists{/gist_id}","starred_url":"https://api.github.com/users/cklosowski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cklosowski/subscriptions","organizations_url":"https://api.github.com/users/cklosowski/orgs","repos_url":"https://api.github.com/users/cklosowski/repos","events_url":"https://api.github.com/users/cklosowski/events{/privacy}","received_events_url":"https://api.github.com/users/cklosowski/received_events","type":"User","site_admin":false},"milestone":null,"comments":13,"created_at":"2015-03-19T16:06:36Z","updated_at":"2016-05-23T20:16:48Z","closed_at":"2016-05-23T20:16:48Z","body":"During the file download process, we use various methods to try and discover the absolute path to the requested file: https://github.com/easydigitaldownloads/Easy-Digital-Downloads/blob/master/includes/process-download.php#L163\r\n\r\nThere is an issue when the following conditions are true:\r\n- The site is a multisite install\r\n- The download file had it's URL pasted into the URL field instead of uploaded\r\n- The Download Method is set to `Forced`\r\n\r\nNone of these conditions is validating as true:\r\n```php\r\nif ( ( ! isset( $file_details['scheme'] ) || ! in_array( $file_details['scheme'], $schemes ) ) && isset( $file_details['path'] ) && file_exists( $requested_file ) ) {\r\n\r\n\t/** This is an absolute path */\r\n\t$direct    = true;\r\n\t$file_path = $requested_file;\r\n\r\n} else if( defined( 'UPLOADS' ) && strpos( $requested_file, UPLOADS ) !== false ) {\r\n\r\n\t/**\r\n\t * This is a local file given by URL so we need to figure out the path\r\n\t * UPLOADS is always relative to ABSPATH\r\n\t * site_url() is the URL to where WordPress is installed\r\n\t */\r\n\t$file_path  = str_replace( site_url(), '', $requested_file );\r\n\t$file_path  = realpath( ABSPATH . $file_path );\r\n\t$direct     = true;\r\n\r\n} else if( strpos( $requested_file, WP_CONTENT_URL ) !== false ) {\r\n\r\n\t/** This is a local file given by URL so we need to figure out the path */\r\n\t$file_path  = str_replace( WP_CONTENT_URL, WP_CONTENT_DIR, $requested_file );\r\n\t$file_path  = realpath( $file_path );\r\n\t$direct     = true;\r\n\r\n} else if( strpos( $requested_file, set_url_scheme( WP_CONTENT_URL, 'https' ) ) !== false ) {\r\n\r\n\t/** This is a local file given by an HTTPS URL so we need to figure out the path */\r\n\t$file_path  = str_replace( set_url_scheme( WP_CONTENT_URL, 'https' ), WP_CONTENT_DIR, $requested_file );\r\n\t$file_path  = realpath( $file_path );\r\n\t$direct     = true;\r\n\r\n}\r\n```\r\nWe need to add another check for files that match the `/file` directory used by multisite.\r\n\r\nWe should also add a general `else` fallback that sets the `$file_path` to `$requested_file` and the `$direct` to `false`."}}
{"actor":{"display_login":"pippinsplugins"}}