This question relates to the following topic: [image] Prevent downloading of posted images Support And why would you let them do that if no one is supposed to see that data? Either put in place a file-size limit that forces the user to web-optimize before uploading, or have a background task run through uploads, and process them to web specs. Keep only the webified files. If you don’t want anyone to save the full-size file, you don’t want the overhead of having it loaded for everyone who views the forum thread either. but here I ask it regarding a more sensitive security aspect. Our users may upload images that contain protected content in the image metadata (e.g. EXIF, header information etc…) which don’t display in the image preview, content they are not supposed to share for confidentiality reasons. However, they may simply forget those metadata are in there and upload the image. So contrary to the topic that I linked above, we do not want to make the image download more difficult (and only possible for tech savvy people), we want to make it impossible to get access to the metadata/EXIF data. The image itself, what is displayed in the post, is not what we need to protect (we don’t care if someone makes a screenshot or get it to full res). So is there a mechanism in place with Discourse that facilitates the processing of images with some script/code (e.g. Python , C, C++) right after they are uploaded, and before the post shows up with it? I do remember that the directory upload tree can be accessed for example to scan them for viruses, but that still is something happening as a concurrent process (which is still alright for us). Here we would want the processing of images to be blocking, to be sure that a swift user cannot have time to grab that image and its metadata before the process has completed. Alternatively, if there have been an update since the topic linked above was made, making it absolutely impossible to download the image and, in particular, its metadata/EXIF, then that would solve the issue.

[image] Wall-E: we want to make it impossible to get access to the metadata/EXIF data You mean like Site setting for "strip image metadata" :wink: ?

Run background process on uploaded image

Product Support

Wall-E (Raphael) March 5, 2021, 6:08pm 3

HA! Brilliant! It did not show up in my search results! (or it was deep down in the list).

Topic		Replies	Views
Prevent downloading of posted images Product Support	28	3790	January 24, 2024
Meta Data From Image Upload Product Support	6	365	August 1, 2024
Bypass image processing / access original source image? Product Support	1	852	October 31, 2018
Disallow anonymous users from viewing image & file URLs Feature	33	5404	April 14, 2025
No strip image metadata works for PNG but not JPG Bug	9	1178	May 5, 2022