Let's say I have multiple ClickBank products (1,2,3,4) with different prices. In order to grant access to different product "pages" I use custom capabilities (as explained in these videos http://www.s2member.com/custom-capabilities-video/
). Now, I need to generate a ClickBank buttons for each of these products (all for level 1).
For the sake of simplicity, let's say I have four "custom capabilities" (cap1, cap2, cap3, cap4). For product 1, I also specify "cap1" under "custom capabilities". For product 2, I specify "cap2" under "custom capabilities". The same goes for products 3 and 4.
Generated URLs have, among other pass-thru variables, this: "s2_invoice=1%3Acap1" (for product 1). For all other products, "s2_invoice" param has appropriate "capN" value.
Now, my concern is this. If "s2_invoice" param for product 1 is changed from this "s2_invoice=1%3Acap1" to this "s2_invoice=1%3Acap1%2Ccap2%2Ccap3%2Ccap4", wouldn't that user be granted access to other products as well? The thing is, anyone can change the request URL and buy a single product but gain access to all other products just by changing s2_invoice param value.
I hope i'm wrong.