ps_product_download

[Greu]

I have set a few pictures to download on my shop - no customer yet.

 

However, I find that 94 downloads occurred in ps_product_download

 

!!!!???

 

How do they do that ? There has been no order for any virtual product.

 

When I test the system as a customer, I can see no way to get a free access.

 

Has there been any such security leak report for 1.5.4.1 ?

 

Is there a way within PS to track back the dowloaders ?

 

Thanks

[Greu]

Has anyone observed the same with virtual products ?

[musicmaster]

How do you see that? I can't see any counter in the ps_product_download table.

Edited August 26, 2015 by musicmaster (see edit history)

[vekia]

do you use some custom theme?

[Greu]

@ musicmaster : there is no counter, there is a listing of downloads with dates, from there you get the count (1 download = 1 ps_product_download table entry)

 

@ Vekia : yes I do, but a pretty official one.

 

(i) Either there is a security failure, or

(ii) there is a bug adding downloads that do not occur

 

Considering human factors makes hypothesis (ii) more plausible : the type of file content would not be of any interest AT ALL to skilled hackers and the profile of interested persons is to hardly succeed using a computer

 

I guess...

 

But this is worth investigating

[musicmaster]

@ musicmaster : there is no counter, there is a listing of downloads with dates, from there you get the count (1 download = 1 ps_product_download table entry)

 

Sorry, but that just isn't true. Please look to your active fields.

[Greu]

Here is a sample screenshot, please help me make sense of this

 

Indeed something is weird, there is only 1 file (1 product) but here it seems 3 versions do exist (3 different filenames for the same display_filename)

Also the expiration date anterior to the date_add  

 

I interpreted - maybe wrongly - the field id_product_download as the reference for each download, then you just count and get the number of times it was downloaded

 

Now I would still tend to understand it that way, please let me know how it has to be understood : If it is not the download id, then the bug is of another nature than I previously thought

 

Thanks

[musicmaster]

I have tested it under 1.5.6.2 and 1.6.1 and see no repeating downloads. Neither do downloads have any effect.

 

It may be that it is your expiration date that is causing strange behavior. I haven't set it so it always "0000-00-00". So I am puzzled why you have set it in the past. But when I set the time for my product in the past I don't see any repeat products either. The download link stays there but when I click it I come on an empty page.

 

Maybe Vekia is right and it has something to do with something customized. But it certainly isn't normal behavior.

[Greu]

Thanks for the feedback.

 

How do you think theme customization would cause this ?

I have not set any date or restriction.

[musicmaster]

I have no idea. The best way to find out what is happening is to experiment. Only you can do that. Do some downloads. See what happens in the database. Look how many of those table rows  are active. Change that strange 2014 expiration date, etc, etc.

[Greu]

yo