Jason (Lead Developer)

Thanks for the heads up on this thread :-)

@ Dan Stramer

~ Thanks for your patience. I apologize for the delay guys.

But is there a way to remove the S2 prompt alltogether from all downloads?
I already have tens of files and would not like to change all the url’s with the shortcode.
In this project I will not need any JS prompt for the download.

You can set this global JavaScript variable to a value of true, to disable ALL confirmation prompts.

var ws_plugin__s2member_skip_all_file_confirmations = true;

So for instance, you might have an MU plugin that does this for you.

Please create this directory and file:
/wp-content/mu-plugins/s2-hacks.php
(NOTE: these are MUST USE plugins, see: http://codex.wordpress.org/Must_Use_Plugins)
(See also: http://www.s2member.com/kb/hacking-s2member/)

<?php
add_action('wp_head', 'disable_s2_js_confirmations');
function disable_s2_js_confirmations()
	{
		echo '<script type="text/javascript">';
		echo 'var ws_plugin__s2member_skip_all_file_confirmations = true;';
		echo '</script>';
	}

You won’t need to add skip_confirmation onto the end of your links now. You’ve disabled these globally.

Thanks for the heads up on this thread :-)

Regarding Single-Sign-On functionality…

s2Member integrates seamlessly with WordPress, so all of the WordPress framework functions like this one, which I would consider strongly in this type of integration, will work just fine for you. See: http://codex.wordpress.org/Function_Reference/wp_authenticate

So how might you go about this? I would create an MU plugin for WordPress that logs someone in using an encrypted username/password combo, and perhaps call upon that in a hidden image tag, or in some way that allows cookies to be set for the WordPress-driven portion of your site, upon logging into another area of your site, which maybe is NOT driven by WordPress.

Please create this directory and file:
/wp-content/mu-plugins/s2-hacks.php
(NOTE: these are MUST USE plugins, see: http://codex.wordpress.org/Must_Use_Plugins)
(See also: http://www.s2member.com/kb/hacking-s2member/)

<?php
add_action('init', 'single_sign_on_handler');
function single_sign_on_handler()
{
	if(!empty($_GET&#91;'ss_username'&#93;) && !empty($_GET&#91;'ss_password'&#93;))
		{
			wp_authenticate($_GET&#91;'ss_username'&#93;, $_GET&#91;'ss_password'&#93;);
			// The user is now logged-in, if the values were correct.
			
			// Let's display an image.
			header('Content-Type: image/gif');
			echo base64_decode('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7');
		}
}
&#91;/hilite&#93;

Now... you might call upon this single-sign-on handler in your other applications,
by displaying a hidden image tag, that looks something like this.

&#91;hilite pre_code&#93;
<img src="http://example.com/wordpress/?ss_username=johnsmith&ss_password=password" width="1" height="1" />

Of course, this is a crude example. If I were setting this up, I would be ABSOLUTELY sure that the values of ss_username and ss_password were encrypted before displaying them in an IMG tag. You might also want to build in an encrypted hash, to ensure the data is coming from your own application, and is not a hacking attempt.

Thanks for the heads up on this thread :-)

I just wanted to clarify something here…

You inspired me. So when writing the welcome page you need to include an OR in your conditional for the admin to see it.

Example: [s2If current_user_is(s2member_level0) OR current_user_is(administrator)]

This is correct, and it IS required in this case. Simply because the conditional that you’re using is NOT testing for Capabilities, it’s testing for a specific Role. In a case such as this, you WILL (as you’ve already done) need your conditional to consider an Administrator role as well. Or, perhaps better, would be to test for Administrative-like Capabilities so you’re covering Editors, Authors, Contributors as well.

[s2If current_user_is(s2member_level0) OR current_user_can(edit_posts)]

Again, this additional consideration for Administrative Users is only necessary when you’re testing for a specific Role using current_user_is(). If you’re testing with current_user_can(), it’s NOT necessary, because an Administrator CAN do anything a User/Member can, and then some, of course.

Thanks for the heads up on this thread :-)

When my members select a page that has been restricted to allow high level member access, they get redirected to the subscriber registration page. How do I change the redirect?

I realize that you’ve already resolved this. For the benefit of other readers, this redirection lands on your Membership Options Page, as configured for s2Member. So changing the redirection simply requires you to change your configuration of s2Member, by pointing to a different Page to be used as your Membership Options Page.

Dashboard -› s2Member® -› General Options -› Membership Options Page

If… on your Membership Options Page, you’d like to get fancy about what you say to people under certain scenarios, I recommend that you explore s2Member’s MOP Vars (Membership Options Page Variables), which are designed specifically to give you advanced control over what happens when someone is redirected to this page, as a result of being denied access to some type of content on your site.

See: Dashboard -› s2Member® -› API / Scripting -› Membership Options Page Variables (MOP Vars)

Regarding Free Registration Forms and PayPal.
This was updated in the latest release, so it’s not an issue any longer.

See: http://www.s2member.com/changelog/#s2-changes-v121213

As for the type of SSL certificate. Any certificate signed by a trusted authority should do. Many people use GoDaddy. Please see: http://www.godaddy.com/ssl/ssl-certificates.aspx

Thanks for the follow-up :-)

I’m sorry to hear that you’ve had so much trouble with this. The next time something like this comes up, please don’t hesitate to ask us for help. We’ll be happy to assist you with s2Member. Also, we’ll continue to work on improving s2Member in this respect. We have to put security first, but there is still room for improvement, we recognize that. Byte-range requests from mobile devices is something we can work to improve on.

Thanks for your patience.

OK. This expiration time is something s2Member implements in conjunction with Amazon S3. s2Member tells S3 to expire the link after 30 seconds automatically, for improved security. This has been optimized for web browsers and not for byte range requests where you have repeated calls against the S3 URL. In most cases, the download begins and ends after a single request. So 30 seconds is more than enough time for a customer to connect to the file and begin downloading the file. It won’t matter how long it takes them to download the file, as long as they connect within 30 seconds.

Now, in cases where you have devices that are attempting to perform byte-range requests, this can become problematic, obviously. 30 seconds after the initial connection, the underlying resource expires. So future attempts (i.e. additional byte-range requests) would require a new File Download Link.

1. s2Member exposes a plugin filter that allows you to modify the default expiration time of 30 seconds. So if you’d like to extend this out longer, in support of devices that make byte-range requests, you can certainly do that.

Please create this directory and file:
/wp-content/mu-plugins/s2-hacks.php

<?php
add_filter('ws_plugin__s2member_amazon_s3_file_expires_time', 'my_custom_expiration_time');
function my_custom_expiration_time(){ return '2 hours'; }
?>

(NOTE: these are MUST USE plugins, see: http://codex.wordpress.org/Must_Use_Plugins)
(See also: http://www.s2member.com/kb/hacking-s2member/)

You can specify any length of time you like. Please use a string that is compatible with PHP’s strtotime() function. Ex: 2 hours, 2 weeks, 10 days, are all valid periods of time.

2. OR (HIGHLY RECOMMENDED). When you’re attempting to reach a large audience and support multiple devices, we recommend integration with BOTH Amazon S3 and with CloudFront. This is a non-issue with CloudFront integration. I think you’ll find that s2Member works much more reliably with CloudFront, and your customers are going to get content delivered from edge locations as well, making everything more enjoyable for you and your customers. See: Dashboard -› s2Member® -› Download Options -› Amazon® S3/CloudFront CDN Storage

s2Member’s CloudFront integration is designed specifically to support byte-range requests through the RTMP protocol, which will support true media streams (i.e. you can SEEK through media files). The default expiration time on CloudFront integration is 24 hours. If you want to extend that out farther, there is a filter for that as well.

Please create this directory and file:
/wp-content/mu-plugins/s2-hacks.php

<?php
add_filter('ws_plugin__s2member_amazon_cf_file_expires_time', 'my_custom_expiration_time');
function my_custom_expiration_time(){ return '36 hours'; }
?>

(NOTE: these are MUST USE plugins, see: http://codex.wordpress.org/Must_Use_Plugins)
(See also: http://www.s2member.com/kb/hacking-s2member/)

You can specify any length of time you like. Please use a string that is compatible with PHP’s strtotime() function. Ex: 24 hours, 36 hours, 2 weeks, are all valid periods of time.

Please let us know if problems persist :-)

@Tom

Thanks for the follow-up :-)

Please note that logging MUST be enabled for you to have log files. You can go to:
Dashboard -› s2Member® -› PayPal® Options -› Account Details -› Logging
and turn it on there please.

Wait a couple days, then send us the log files privately via this contact form.
s2Member® » Private Contact Form
/wp-content/plugins/s2member-logs/… sends us all files in this folder please.

Thanks for the follow-up :-)

Ok, so I sorted out the Bitly shortener.

Awesome!

So now the only issue is that everything is showing up as expired when I try to create a link in the “Members registration access links”. I am copying and pasting the subscriber id from either Paypal or within the S2member plugin “browse member” section. Maybe I am not getting what a unique ID is?

Great question. I will try to clarify that a bit further. A new unique Paid Subscr. ID, is one which has NOT been used by a customer on your site yet. If you grab the Paid Subscr. ID from an existing customer’s account, that’s not going to work in a Registration Access Link, because s2Member has already allowed this customer to register in the past, with the same Paid Subscr. ID (e.g. they’re already a User of the site).

Normally you would only generate Registration Access Links manually, in special circumstances. For instance, if your site was experiencing down time, and a customer never completed registration; or if they never got the email from your site – something like that. In cases like that, they’ve NOT registered yet. So, you could simply pull the Paid Subscr. ID from PayPal (i.e. a transaction ID, or the subscription ID), and use that when you create a Registration Access Link for the customer manually.

In other cases, if you just want to create Registration Access Links manually for whatever reason, you will need to generate a new unique Paid Subscr. ID for each customer. If they paid you through PayPal, or another payment gateway, you could use the transaction ID or subscription ID supplied by the payment gateway. Or you can just make one up if you like. A Unix Timestamp would work for this. Whatever you prefer really, as long as it’s unique (i.e. has NOT been used by a customer registering for access to your site yet).

Please let us know if problems persist :-)

@Jason Ward

You said…

Which both give expired errors.

That sounds like it could be related to the underlying link itself (i.e. the URL before it is shortened). If the link you are generating has already been used, or is expired, it won’t matter what shortening service you’re using, because the underlying URL on your site will still lead to an expired link warning, issued by s2Member.

Registration Access Links automatically expire after 2 days.

Another thing to be aware of, is the Paid Subscr. ID field when you generate a Registration Access Link manually from the Dashboard. If you generate a Registration Access Link with a Paid Subscr. ID value that is NOT a new unique value, the link will issue an expiration error, regardless of which shortener is in use.

Please let us know if problems persist :-)