not using action token validation for image download

diff --git a/start.php b/start.php
index a15215118a7274ce021cf1fa4c334c6505e9220e..c777331c69266cb9d27283d9a18b78d63c007d62 100644 (file)
--- a/start.php
+++ b/start.php
@@ -73,6 +73,9 @@
                \r
                // slideshow plugin hook\r
                register_plugin_hook('tp_slideshow', 'album', 'tidypics_slideshow');\r
+               \r
+               // no checking security token for download\r
+               register_plugin_hook('action', 'tidypics/download', 'tidypics_download_override');\r
        }\r
        \r
        /**\r
@@ -417,6 +420,21 @@
        }\r
        \r
        \r
+       /**\r
+        * Called before validating the security token on a download link\r
+        * We don't need security as this is not a true action (it doesn't change any data)\r
+        * \r
+        * @return false (shouldn't return though since the action exits\r
+        */\r
+       function tidypics_download_override($hook, $action)\r
+       {\r
+               global $CONFIG;\r
+               \r
+               include $CONFIG->actions[$action]['file'];\r
+               \r
+               return false;\r
+       }\r
+       \r
 \r
        // Make sure tidypics_init is called on initialisation\r
        register_elgg_event_handler('init','system','tidypics_init');\r

diff --git a/views/default/object/image.php b/views/default/object/image.php
index 01beb25f61c71a50569587564e00c0354bcc6969..dd52f872ed25f48f1c1a8e73a12c0985d0273eb8 100644 (file)
--- a/views/default/object/image.php
+++ b/views/default/object/image.php
@@ -149,10 +149,8 @@
                                // this code controls whether the photo is a hyperlink or not and what it links to 
                                $image_link = false;
                                if (get_plugin_setting('download_link', 'tidypics') != "disabled") {
-                                       // admin allows downloads so default to download link
-                                       $ts = time();
-                                       $token = generate_action_token($ts);
-                                       $image_link = $vars['url'] . "action/tidypics/download?file_guid=" . $image_guid . "&view=inline&__elgg_token={$token}&__elgg_ts={$ts}";
+                                       // admin allows downloads so default to inline download link
+                                       $image_link = $vars['url'] . "action/tidypics/download?file_guid=" . $image_guid . "&view=inline";
                                }
                                // does any plugin want to override the link
                                $image_link = trigger_plugin_hook('tp_image_link', 'image', $image, $image_link);                               

diff --git a/views/default/tidypics/image_menu.php b/views/default/tidypics/image_menu.php
index cb004395e7eb482151b75ad590df737f1c9e2b57..299f4b02668289cee7fe597773715a24cd8b27e3 100644 (file)
--- a/views/default/tidypics/image_menu.php
+++ b/views/default/tidypics/image_menu.php
@@ -43,10 +43,7 @@
        }\r
        \r
        if (get_plugin_setting('download_link', 'tidypics') != "disabled") {\r
-               $ts = time();\r
-               $token = generate_action_token($ts);\r
-               \r
-               $download_url = $vars['url'] . "action/tidypics/download?file_guid=" . $image_guid . "&__elgg_token={$token}&__elgg_ts={$ts}"; \r
+               $download_url = $vars['url'] . "action/tidypics/download?file_guid=" . $image_guid; \r
 ?>\r
 <li id="download_image"><a href="<?php echo $download_url; ?>"><?php echo elgg_echo("image:download"); ?></a></li>\r
 <?php\r

diff --git a/views/default/tidypics/tagging.php b/views/default/tidypics/tagging.php
index ebaf0dc9438a7a963ace05a2d866cd347e4c6d61..9ebec7c1eee5e562b6ed59c9b615c9a8fc8c4596 100644 (file)
--- a/views/default/tidypics/tagging.php
+++ b/views/default/tidypics/tagging.php
@@ -63,6 +63,7 @@
        }\r
 \r
 ?>\r
+<div class="clearfloat"></div>\r
 </div>\r
 <div id="tidypics_delete_tag_menu" class="tidypics_popup">\r
 <div class='tidypics_popup_header'><h3><?php echo elgg_echo('tidypics:deltag_title'); ?></h3></div>\r