wc_order download link can be shared with anyone.

  • Resolved DB

    (@destructiveburn)


    3 years, 7 months ago

    Hello, I just noticed that if someone purchases a digital download, They can copy that wc_order link and share it with anyone.

    I did a test and copied one of them onto another browser not logged in and yeah I was able to download the file.

    At first, I was thinking it’s IP-based and it’s not. I tried my phone with a different IP and I was still able to download the file with the same wc_order link. I also tried another computer with a different ISP line and still able to download it.

    This needs to be fixed. This grants someone the option to download the file without even logging in and paying for it.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support Gabriel – a11n

    (@gabrielfuentes)

    Hi there ??

    It sounds like you are using the redirect-only File download method for your digital downloads. If so, please go to WooCommerce > Settings > Products > Downloadable Products > File download method, and from there select Force Downloads and click Save Changes.

    https://www.screencast.com/t/kdh5e9SFHme

    Kindly let me know if that works for you.

    Cheers.

    Thread Starter DB

    (@destructiveburn)

    Hello, Force Downloads were already set. This should be fixed to “ONLY THE IP” that purchased is the one that can download. Everyone else would be redirected to the landing page.

    Thread Starter DB

    (@destructiveburn)

    Problem Solved. I guess I did not have “Downloads require login” enabled under WooCommerce / Settings / Products / Downloadable products

    I’ll mark this post as Resolved. If Anyone has this issue, make sure to check that and use Force downloads.

    Have a good day!

    Plugin Support Gabriel – a11n

    (@gabrielfuentes)

    That’s awesome! ??

    Great! If you have any further questions, you can start a new thread.

    Cheers! ??

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘wc_order download link can be shared with anyone.’ is closed to new replies.

Tags