Using K2 2.71 w/ J3.65.

All attachments return 404 error:

example w/ 9 attachments: nvcacademy.net/index.php?option=com_k2&view=item&id=1179:prepare-for-love-part-01&Itemid=137

attachments are there, I tried setting attachments folder, copying attachments to another folder and pointing to that one and leaving the parameter blank.
a direct link to the 1st attachment on the page above works nvcacademy.net/media/k2/attachments/EB_Calling_a_Pause_0001.pdf

From back end, downloading file returns this error: File does not exist

the failing url looks like this:
nvcacademy.net/administrator/index.php?option=com_k2&view=item&task=download&id=423_9437645427bfa2d864bdb952ded656ac

what is this value: 9437645427bfa2d864bdb952ded656ac and where is it stored? I can't find it anywhere in the db or in a file.

I recently upgraded to 3.65 from 1.5.

Any idea for resolution or further investigation is welcome.

thanks.

I found that if the hash check is removed from item.php in the /administrator/components/com_k2/models folder, it works.

These nice php developer folks found the issue and shared it with the world:
www.itoctopus.com/404-error-when-trying-to-download-a-k2-attachment

Curious if K2 developers, know of this issue and have a plan to address it?

item.php in /administrator/components/com_k2/models
commented out hash check
$attachment = JTable::getInstance('K2Attachment', 'Table');
if ($mainframe->isSite())
{
$token = JRequest::getVar('id');
$check = JString::substr($token, JString::strpos($token, '_') + 1);
$hash = version_compare(JVERSION, '3.0', 'ge') ? JApplication::getHash($id) : JUtility::getHash($id);
/*if ($check != $hash)
{
JError::raiseError(404, JText::_('K2_NOT_FOUND'));
}*/
}
$attachment->load($id);

Hello there,

Which version did you patch?

Using K2 2.7.1 w/ J3.65.

From what I can see the code is correct in the upcoming version, so you are covered when you update K2.