# Links to media break in copy or quote when "secure media" is on
**URL:** https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370
**Category:** Bug
**Created:** [October 16, 2020, 2:41pm UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370 "2020-10-16T14:41:42Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Alon1](https://meta.discourse.org/u/Alon1)
#### Post date: [October 16, 2020, 2:41pm UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/1 "2020-10-16T14:41:42Z")
Steps to reproduce:
1. Enable secure media
2. Create a new topic and drag media (pdf file would do nicely)
3. Reply to your own topic with a copy-paste of the media (or just quote yourself)
Now you can observe that clicking on the original media attachment works fine, but clicking on the quoted/copied media link (even though it is the **exact same link** ) leads to error page:
I suspect it might have to do with the referrer tag because that is the only difference.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 19, 2020, 2:15am UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/3 "2020-10-19T02:15:13Z")
I am not sure this is an allowed used case, secure media means that the media is strongly associated with a post and this is depending on loose association.
@martin can confirm later this week
---
### Author:  [@Alon1](https://meta.discourse.org/u/Alon1)
#### Post date: [October 19, 2020, 4:10am UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/4 "2020-10-19T04:10:56Z")
Thanks for your reply!
If the intention is that the media is associated with the post then there is a much bigger “bug”, because as it works right now, you can copy the url to the media (it looks like this `https://www.my.domain/secure-media-uploads/meta/original/1X/db86496651c78aa64adbe43b2907654555002.pdf` ) and simply share it with **anybody** who is logged in to Discourse, and they can paste it in their browser address bar (without even opening Discourse) and download the file.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 19, 2020, 4:13am UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/5 "2020-10-19T04:13:19Z")
This feature only works with s3 and it is unclear if you have it enabled or not?
---
### Author:  [@Alon1](https://meta.discourse.org/u/Alon1)
#### Post date: [October 19, 2020, 4:13am UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/6 "2020-10-19T04:13:58Z")
Yes, S3 is enabled. Otherwise I wouldn’t be able to use “Secure Media”.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [October 19, 2020, 4:15am UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/7 "2020-10-19T04:15:30Z")
Well I recommend you test this a lot more carefully, post an image in a pm and notice how end users without access to the pm do not have access
If logged in users have access to the post with the pdf they can download it
---
### Author:  [@Alon1](https://meta.discourse.org/u/Alon1)
#### Post date: [October 19, 2020, 4:16am UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/8 "2020-10-19T04:16:32Z")
ah, that is a good point. I will test it right away.
EDIT: Ok apologies, you are right, only users with access to the post can download the media. Still, it is not limited to actually clicking on the post link, so given that the link was copied, and the user has access to to original media - I still think it should allow to download it without forcing the user to copy-paste the URL to his address bar
---
### Author:  [@martin](https://meta.discourse.org/u/martin)
#### Post date: [October 19, 2020, 11:20pm UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/9 "2020-10-19T23:20:44Z")
I will try to take a look at this for you this week, thanks for the report.
---
### Author:  [@martin](https://meta.discourse.org/u/martin)
#### Post date: [November 25, 2020, 4:48am UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/10 "2020-11-25T04:48:30Z")
Sorry for the delay, this is fixed by [FIX: Add secure media url to SERVER\_SIDE\_ONLY list by martin-brennan · Pull Request #11348 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/11348)
---
### Author:  [@martin](https://meta.discourse.org/u/martin)
#### Post date: [November 25, 2020, 4:48am UTC](https://meta.discourse.org/t/links-to-media-break-in-copy-or-quote-when-secure-media-is-on/167370/11 "2020-11-25T04:48:41Z")