Server download link hiding makes it useless

Is this strictly related to Ubuntu?

I just gave it a shot and had no issues (Same area in the repo as all other packages).
All the download links are automation-generated so if one works then all should work.

I am still not understanding where this is directed… The Plex/web client performing the download OR ???

1 Like

No, it’s not just Linux.

Clicking the link starts a download as expected.

Copying the link gives a masked token, which can’t be pasted elsewhere for download.

(Or rather it can be, but because it’s not a good token, the download isn’t the expected Plex Pass version.)

1 Like

Pretty sure it’s been that way for a long time.

There is javascript behind the button. I doubt they want ‘cut and paste’.
(but could be wrong)

It has been that way the past 2 updates I have done on the beta channel - prior to that, I could copy-paste. So it’s a recent change.

1 Like

So it sounds like you see the issue now? That relatively recent change (I can’t remember how recent) means the copied link doesn’t download the correct version of the server?

Like I’ve said a few times, I understand that developers may have had reasonable motivations for making this change, but I don’t know if they appreciated how it breaks/complicates the workflow of actually upgrading our remote servers when the server asks us to upgrade.

You can see in the comments above that people are jumping through hoops to get the link anyway, regardless of the obscuring javascript, because downloading to a local computer that doesn’t actually run the server isn’t as useful.

It may be a recent change but if you look at the URL,

Have you tried replacing the masked token with your token?

Does it then work?

I ask because it might have been a potential security issue if you copied your URL and pasted out in the public somewhere.

I don’t know why it was done but improving security (knowing the browser does have your Token) makes a whole lot of sense.

1 Like

As followup, If you’re using some automation, here is what I use in the Debian package to pull values from Preferences.xml

# Extract value from Preferences.xml
# Return null string if not present
GetPref()
{

  Retval=""

  # This must remain as written with everything escaped for variables to work.
  # Do not attempt to extract unless exists in the file.

  if [ -e "$2" ]; then
    if [ "$(grep "$1" "$2" | wc -l)" -gt 0 ]; then
      Retval="$(grep -iPo \(\?\<=$1=\"\)\[\^\"\]\* "$2")"
    fi
  fi

  echo "$Retval"
}

A script which uses this would be:

#!/bin/bash
# Extract value from Preferences.xml
# Return null string if not present
GetPref()
{

  Retval=""

  # This must remain as written with everything escaped for variables to work.
  # Do not attempt to extract unless exists in the file.

  if [ -e "$2" ]; then
    if [ "$(grep "$1" "$2" | wc -l)" -gt 0 ]; then
      Retval="$(grep -iPo \(\?\<=$1=\"\)\[\^\"\]\* "$2")"
    fi
  fi

  echo "$Retval"
}

#
# Get Plex token from Preferences
Token="$(GetPref  PlexOnlineToken "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Preferences.xml")"

# print the token
if [ "$Token" != "" ]; then
  echo  "My server token:   $Token"
else
  echo "Error: Unable to retrieve PlexToken"
fi

Edit the path to your preferences.xml if different.

So that’s all I was aiming for, noting this is happening for other users to see when they look, and to make sure the devs are aware of this issue.

@ChuckPa would you mind sending this topic up the chain, however it’s done inside of Plex?

If devs conclude that in the end Javascript to obfuscate the URL is more important than ease of upgrade of remote systems, fine. I just want to make sure they’re aware of how we’ve been impacted by the change.

I’d even suggest a compromise, a note under the link warning anyone against giving out the URL.

Better would be if these releases went through the normal package managers, but I imagine that note option is easier.

Why don’t you use the package managers (RPM and DEB) repositories are fully online. (run in crontab)

Some of the NAS vendors are “less than optimal”.

I can remotely update my any host (server or NAS) without ever opening the GUI.

As example, even though I use the repository, I can do this:

  1. Establish ssh tokens between the hosts (ssh-copy-id)
  2. Download the Plex DEB file (by whatever means you wish to)
  3. scp ~/Downloads/plexmediaserver*.deb glocker:/tmp/plex.deb
  4. ssh glocker sudo dpkg -i /tmp/plex.deb
  5. rm ~/Downloads/plexmediaserver.deb

With a little work in a script, adding error checking, you can make the filenames exact but I hope this shows my point.

I will forward to them but this should not be a ‘show stopper’ in ANY way

Turn up your “geek” ? :smiling_imp:

Again, this comes up when the Plex server advises us to install versions that aren’t in the repositories. I believe someone mentioned them being versions made available to Plex Pass members, but not everyone else.

Often, like at this moment, Plex server is advising the latest version in the repository. SO the xxxx URL returns the same version as the normal download link. But, in other times, the server asks us to upgrade to a version that isn’t in the repository, and then the two URLs give different versions.

Like I said, if Plex would add these to the repositories that’d be even better, but I figure that’s more work than just adding the little note warning against sharing the URL.

PlexPass / beta download isn’t in any repository. It can only be downloaded through Plex/web with an active PlexPass. (It’s gated behind your account’s PlexPass flag.)

That’s how they designed it.

By changing the update channel to “public”, then everyone (Free or PlexPass) has access.

I hear what you’re saying but there is an element of “holding it wrong” going on.

  1. Debian/RPM/NAS package stores – All get the “public” version.
  2. PlexPass / Beta / Early Access – for paying customers – by OPTING IN and changing the channel selector in Plex/web - General

If you don’t want Beta being prompted, change the channel selector to Public.

Again, I have forwarded to them

And so you’ve answered your own question:

Why don’t we just use the package managers? Because these packages aren’t in the repositories.

It seems like you knew this beforehand, so I’m not sure what the point of that runaround was.

1 Like

You want beta packages? – NOT in the repo. Period. That’s how it has always been. Will never change. As promised, I did ask about why the token is masked. I will report back here when they let me know.

My questions were rhetorical

Those means being restricted to “through your browser”, since the download link is broken now. Previously, one could download it directly on the server with wget or curl, skipping the scp command you proposed.

I fail to see how adding an extra step makes the process more geeky, unless you find scp to be an inherently more geeky command than wget. To each their own.

In an effort to “turn up my geek”; I have made a userscript to smooth over the issue. It changes the download links, so they include the token again, restoring the old workflow.

Hopefully this is only a stop-gap measure until the proper links get restored by the developers. :slight_smile:

2 Likes

4 posts were split to a new topic: Plex downloading wrong version of PMS (public vs. beta)

Since it’s been two months without any updates (and the thread will auto-close after 3 months of no activity), I thought I’d ask if @ChuckPa has heard anything from the development team?

More specifically, if it considered a bug to be fixed, or it is considered an intentional feature to test if the beta testers of Plex’s software (and thus paying customers) are up for the challenge of updating its software?

Thanks in advance.

1 Like

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.