# File attachments in restricted categories should be restricted

**URL:** <https://meta.discourse.org/t/file-attachments-in-restricted-categories-should-be-restricted/60765>\
**Category:** Feature\
**Created:** [11. April 2017 um 10:25 UTC](https://meta.discourse.org/t/file-attachments-in-restricted-categories-should-be-restricted/60765 "2017-04-11T10:25:06Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![tophee](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tophee/32/73406_2.png) [@tophee](https://meta.discourse.org/u/tophee)\
**Post date:** [11. April 2017 um 10:25 UTC](https://meta.discourse.org/t/file-attachments-in-restricted-categories-should-be-restricted/60765/1 "2017-04-11T10:25:06Z")

</div>

Currently, files that are uploaded to a restricted category are accessible to anyone, even users who are not logged in. Chances are that these files get indexed by search engines and thus become public. I agree with @tobiaseigen that this is quite a serious issue:

> [@Attachments available to any user with link](https://meta.discourse.org/t/attachments-available-to-any-user-with-link/18868/5):
>
> This is a fairly serious issue because the presumption is that the attached file has the same security settings as the post it goes in.. this is not true at the moment and may result in unpleasant surprises. In the meantime and until this issue is solved, how about adding a warning note to the upload interface along the lines of “Note: attachments to posts in this forum, even in secure categories, are available to any user with the attachment URL.”

But I am not sure what exactly the current state of affairs is regarding this, except that, some time ago, @dmitry_fedyuk created the [restrict files plugin](https://meta.discourse.org/t/restrict-files-plugin-sell-a-digital-content-on-your-discourse-forum-version-1-2-1-2015-07-19/29775) whose [latest version seems to be 2.1](https://discourse.pro/t/topic/33) which is [confirmed to be compatible with discourse v1.7.0.beta9](https://discourse.pro/t/topic/33/6).

I would like to ask conference participants to upload their papers as attachments on my forum but I cannot do this unless I know that only users with access to the specified category can access the uploaded papers.

So my question to @dmitry_fedyuk is: can you confirm that the [current version](https://github.com/discourse-pro/df-restricted-files) is compatible with discourse v1.8.0.beta10? I would also be curious to hear about any user experiences with the plugin.

---

_[View the full topic](https://meta.discourse.org/t/file-attachments-in-restricted-categories-should-be-restricted/60765)._