This is a persistent problem I'm getting with Linklok IPN.
Linklok is a small PHP script that serves files outside the webroot to users who authenticate via a embedded token in the URL.
I've reproduced the relevant portion of the code here:
function xfpassthru($file)
{
global...