Downloads don;t work after updating to 2.3.5

-- HikaShop version -- : 2.3.5
-- Joomla version -- : 2.5
-- Error-message(debug-mod must be tuned on) -- : file not found

After updating from 2.3.4 to 2.3.5 downloads don't work anymore
I have my downloadables outside website's root folder as it is suggested for security reasons and configured the path like this: ../MY_SECURE_FOLDER/
It was working for a year now, what could possibly go wrong?

I can confirm this bug on latest Hikashop 2.3.5.

Path to 'uploadsecurefolder' has missing trailing slash.
Quick fix is to change file administrator\components\com_hikashop\classes\file.php
on line 363 from to
This issue comes from latest change in getPath() method on lines 695-698.
Function realpath() strips trailing delimiter.

Hi onsitenet,

First, can you please re-download HikaShop 2.3.5 in order to be sure that you're using the last package.
The "download file" system has been modified in the last version with some security improvements ; the ".." directory is no more authorize and it is prefered to specify the absolute path, so the system can always check that the requested file is right in the secure folder.

Regards,

I have the latest version downloaded today(17:29).

File administrator\components\com_hikashop\classes\file.php was last modified 02.01.2015 and this modification introduced this bug.

Also all other methods using method getPath() are not working correctly.
Files uploaded before this change can't be downloaded or deleted.

Files uploaded after this change are located in wrong location, as last folder in path is prepended to file name.
Also "safe" folder is no longer safe, as .htaccess file is saved as safe.htaccess .
For example I uploaded file payment.jpg to product id 97 on demo site and it's accessible over url:
demo.hikashop.com/media/com_hikashop/upload/safepayment.jpg

How would this "absolute path" look like?
...an example(?)

Hi Korzo,

I don't think that you have the same exact problem than "onsitenet".
For the missing slash ; it comes from the "realpath + JPath::clean" functions, I made some modifications and Nicolas just upload a new package.

Regards,

any chance someone give me an example?
(...it's for apache server with cpanel)

Jerome:
I hadn't problem at all. I was able to reproduce the issue on my dev machine, but failed to explain it.
As I can see it's fixed now.

onsitenet:
Chances are you have to change nothing. Download the latest version(uploaded minutes ago) and update your site.(don't forget to make a backup).
It should work as before update to 2.3.5.

That is correct! I've changed nothing and it works now.

I'm still interested to what Jerome said about "absolute path" because I always worry about security. I wish this can be clarified now we're bumped into it.

Thank you 2 ...and many thanks to the Devs for being quick & responsive.

Hi,

Suppose that your website is in the folder /var/www/ and that the secure folder where you put your files is /var/secure/
the path /var/secure/ is the absolute path of your secure folder while ../secure/ is the relative path to your secure folder.
Both are correct and you can use both in the option of HikaShop. There was a bug with the relative path handling in HikaShop 2.3.5 and that's why Jerome recommended that you set the absolute path instead of the relative path.