Security Flaw in DownloadController.cs: Vendor can download any Download file by Id

I might be wrong here, so please sorry if this is a mistake. In Admin DownloadController.cs there is a method to download files by id which is really unsecured.

At the moment we only have the attribute: [AdminAuthorize] which will also give access to Vendord to download any file.

There should be a way to validate that this method should only be accessed by users in the Role Administrator.

Hmm. You're absolutely right. But if we limit this method to the administrators role, then vendors won't be able to upload (then download) files for downloadable products because we cannot load (find) a product by "download" entity

I've just created a work item but I'm not sure how to fix it yet. Maybe, download files by GUID (not ID)

What about some sort of ACL on the Download?  You can download it if you uploaded it or you're in the Administrators group (or whatever role is chosen).

Fixed. Please see changeset f586c59055e4