Anonymous can access uploaded images on private notes and without login
Open
bug
security
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
When setting CMD_ALLOW_ANONYMOUS=false and CMD_IMAGE_UPLOAD_TYPE=filesystem
anonymous user can access uploaded images using the direct url (such as https://md.example.com/uploads/upload_xxxxxxxxxxxxxxxxxxxxxxxxx.jpg)
This is also true for notes set to 'private'.
### Expected behaviour:
Images should have the same restrictions as notes. At least it should be possible to disable anonymous access to images.
Contributor guide
Assessment
This issue has not been assessed yet.