# Attachments available to any user with link

**URL:** <https://meta.discourse.org/t/attachments-available-to-any-user-with-link/18868>\
**Category:** Feature\
**Created:** [14 Agosto 2014, 9:52pm UTC](https://meta.discourse.org/t/attachments-available-to-any-user-with-link/18868 "2014-08-14T21:52:14Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![lake54](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lake54/32/121955_2.png) [@lake54](https://meta.discourse.org/u/lake54)\
**Post date:** [14 Agosto 2014, 9:52pm UTC](https://meta.discourse.org/t/attachments-available-to-any-user-with-link/18868/1 "2014-08-14T21:52:15Z")

</div>

Repro

1. Create a restricted category, and post an attachment in there.
2. With another account, one that doesn’t have access to the restricted category, try and access the uploaded file (e.g. the original user has copied the link, perhaps in a forwarded email by mistake)
3. User is able to access the file

This is more a people issue rather than a technical one I think, since instead of sharing the link, they could just email the attachment themselves anyway. If there is, however, any way of validating permissions before allowing access to an attachment that could be worthwhile, even a Good Thing™?

---

_[View the full topic](https://meta.discourse.org/t/attachments-available-to-any-user-with-link/18868)._