[squidsk]

Two bugs to report.

First bug comes with a feature request. The bug is the security token bug, but different from what others have described. Here's how to reproduce the bug. First guests have download permissions. Second have your site open in two different windows/tabs, one of which points to a download the other to any page what so ever. Either be logged in on both or logged out on both, it doesn't matter. If on the non-download page you log out, or log in, and then try to download the file from the download page without refreshing you'll get a security token error. The request that goes along with this, is to remove the security token from the url of the download button and have downloads.php grab it from the $vbulletin after the download button is clicked, as that should stop all security token issues. It would also prevent security token errors when a user posts a link directly to the download button and others try to follow it, which of course won't work as the security tokens would be different.

EDIT: This bug can be reproduced as well by logging in with a second account, the guest account does not necessarily required download permissions.

Second bug. If a file does not exist in the download directory, but a entry points to it, you do not get a vbulletin error message, but just a plain php message. The block of code in question is at line 754 in version 6.0.9. Wrapping that code in an if(file_exists($dlfilename)) would probably solve the problem.

EDIT 2: Both bugs are present in both 5.1.2 and 6.0.9.