Image upload permissions

[roguemat]

We’re running a closed invite-only forum, and have just noticed that uploaded images are accessible without logging in.
Also, files uploaded to categories with limited view permissions, are also viewable by everyone.

I’ve checked the “prevent anons from downloading files” but it doesn’t seem to do anything.

Help?

[Falco]

Are you on latest? I remember some recent changes around this.

[roguemat]

v1.8.0.beta5 +106 with a smiley face

[codinghorror]

Are you using a CDN?

[roguemat]

Sorry, forgot to respond.
No.

[codinghorror]

prevent anons from downloading files

Hmm, not sure, this setting should work. Any ideas @zogstrip?

[zogstrip]

That setting is only for attachments though. Only attachments hit the rails app. Images are directly served by NGINX.

[codinghorror]

Ah so the title of this topic is wrong, it is not about file upload permissions, it is image permissions. Bad title, I will fix.

For the record

• files = file attachments
• images = images, pictures

very different things…

[tgxworld]

Probably a duplicate of

Disallow anonymous users from viewing image & file URLs

This came up in an internal discussion. Putting it up here so we can track it. Discourse image URLs on a invitation-only forum are still publicly viewable. Although these URLs are technically unguessable, e.g. /uploads/default/original/2X/4/4150d682b0472888f0014f67f8c09852008067d4.jpg … some internal communities deal in such sensitive information that outright disallowing any viewing of these images would be preferable. We do already have a setting for prevent anons from downloading files, so…

[roguemat]

Yeah, you’re right, sorry. But it also shows that to an average user the wording is confusing, as is the behavior difference between uploading a file and image.

@tgxworld, yup, thanks!