HI.
I clicked  to download the update but it appears to be the same as my old file. All files inside even have the same dates as my old file. I also cannot find an update notes text file.
Please let me know because I had a security issue today.
Thanks,
~John

Hi John,

CHeck to see if the download.php  has this:
o.order_CustomerID = '%s'
AND s.SKU_ID = '%s'
AND ( o.order_Status = '2' OR o.order_Status = '3' ) ",$_SESSION["customerID"],$_

Hi,
Please, replace the WHERE clause with the code above.

Oli
Cartweaver Support Team

Hi John,
The big questions is HOW it got there .

Possible causes ( This is just a list of ideas.. I cant say what i'; your case)

a) querystring parameter not being properly cleaned up. ( CW's code always cleans up it's input. If you added any code of your own you should also check for that.  If you find out the point of entry you will have an easier time pinpointing how to fix this).
b) FTP Credentials being compromised  ( I recommend always changing FTP passwords if you discover any sort of issue)
c) Malware on your machine causing unwanted stuff to piggyback on your form actions when visiting websites.

Oli
Cartweaver Support Team     

What, exactly, does this update fix?

Hi Sam,.
This update prevents a malicious user with an account from obtaining a download without a verified order.

Oli
Cartweaver Support Team