While we don't show links to downloads when a payment isn't completed, we should also be verifying it upon download as well.
Committed the fix so we can deploy, we should build a comprehensive set of unit tests around the file download process and URL generation (logging it)
Looks good - I have no permission to download file if the payment status is not complete. I do when it is complete.
Since updated to 2.5.11, there is a conflict with EDD recurring payments.
If a payment is "Renewal" I have no permission to download the files. It only affects customers who renewed at least once. Not sure if it's related with this issue, but I think it can be related.
@boluda We're addressing that in an update for Recurring Payments today.
@pippinsplugins Great!
@boluda that release should be out the door. Thanks for helping us test it out.
Glad to help!