Bug Fixed Users Can Buy Child Resources Without Owning Parent

[VisEntities]

Just realized something for parent/child resources, users can add the parent to their cart to unlock the ability to add a child. Then before checking out, they simply remove the parent from the cart and purchase the child by itself. Boom, they can download the child without ever owning the parent (which they probably grabbed off some pirate site anyway) GG

 

[VisEntities]

Proposed solutions:

1. Block checkout if parent resource is missing from the cart
2. Lock child resource download access until parent ownership is actually verified

 

[Clement]

The cart is expected to be checked before checkout if it happens that they removed the child.
I would have to check but I am pretty sure, or maybe not on the checkout page

 

[VisEntities]

To be honest, I'm just making an assumption about how this guy managed to buy the child resource alone. The only thing that came to mind was that he added the parent to the cart and then removed it before checkout. But I can’t verify it

 

[Clement]

You were right indeed.
I'm releasing a fix.