remove hash for external images, but use token url parameter instead

1 files changed, 2 insertions, 6 deletions

diff --git a/inc/fetch.functions.php b/inc/fetch.functions.php
index 3c700b35b..207ad9e5f 100644
--- a/inc/fetch.functions.php
+++ b/inc/fetch.functions.php
@@ -101,8 +101,8 @@ function checkFileStatus(&$media, &$file, $rev = '', $width=0, $height=0) {
 
     //media to local file
     if(media_isexternal($media)) {
-        //check hash
-        if(substr(PassHash::hmac('md5', $media, auth_cookiesalt()), 0, 6) !== $INPUT->str('hash')) {
+        //check token for external image and additional for resized and cached images
+        if(media_get_token($media, $width, $height) !== $INPUT->str('tok')) {
             return array(412, 'Precondition Failed');
         }
         //handle external images
@@ -111,10 +111,6 @@ function checkFileStatus(&$media, &$file, $rev = '', $width=0, $height=0) {
             //download failed - redirect to original URL
             return array(302, $media);
         }
-        // check token for resized and cached images
-        if (($width || $height) && media_get_token($media, $width, $height) !== $INPUT->str('tok')) {
-            return array(412, 'Precondition Failed');
-        }
     } else {
         $media = cleanID($media);
         if(empty($media)) {