You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Tests proving the plugin cannot become a way around access control: the set of
hooks it registers is asserted exactly (all of them fire after CatalogBookHandler::download has run the access policy), it registers no
route of its own, and it declines the hook when no file is present.
Confirmed on a live server as well — requesting the same MP3 with ?audioStream=1 returns 206 when the file is open, and 404 when the file has
no direct sales price, when the publication format is unavailable, and when
the publication is not published: identical to the ordinary download.
Cypress specs (cypress/tests/functional/AudioPlayer.cy.js): enabling the plugin
and saving its settings, building the player from the audio publication format,
a Range request answering 206 and an unsatisfiable one answering 416, and a
file that does not belong to the format being refused with exactly the same status
with and without ?audioStream=1.