Unexpected behaviour: Uploaded images are accessible for everyone

When I upload an image (stored on the server itself) the image is not protected like the *.md-file is.
I understand the problem to keep another access-level for each image but if I mark a note as private I also expected the pictures to be private only. In fact I can even access them without being logged in just by having the URL.

Start by tracing the server-side image upload and serving entry points, then compare their access checks with the rules used for private notes and *.md files. Reproduce access to an uploaded image URL while logged out and for a private note; done means private-note images are no longer publicly accessible.

Scritto dal modello di indicizzazione a partire dal testo della issue.