Issue Summary: Links to media break when copied or quoted with “Secure Media” enabled.
Alon1 reported an issue where copying or quoting a media link (e.g., a PDF file) results in an error page, despite being the same link as the original attachment. Alon1 suspects this might be related to the referrer tag.
sam questioned whether this is an allowed use case, as “Secure Media” implies a strong association with the original post. However, Alon1 pointed out that anyone with the copied URL can access the media, potentially revealing a larger issue.
sam noted that this feature only works with S3, and Alon1 confirmed that S3 is enabled. sam suggested testing the feature further, and Alon1 discovered that only users with access to the original post can download the media.
martin acknowledged the issue and promised to investigate. martin later reported that the issue has been fixed with a pull request (https://github.com/discourse/discourse/pull/11348).
Steps to reproduce:
Now you can observe that clicking on the original media attachment works fine, but clicking on the quoted/copied media link (even though it is the exact same link) leads to error page:
I suspect it might have to do with the referrer tag because that is the only difference.
I am not sure this is an allowed used case, secure media means that the media is strongly associated with a post and this is depending on loose association.
@martin can confirm later this week
Thanks for your reply!
If the intention is that the media is associated with the post then there is a much bigger “bug”, because as it works right now, you can copy the url to the media (it looks like this https://www.my.domain/secure-media-uploads/meta/original/1X/db86496651c78aa64adbe43b2907654555002.pdf ) and simply share it with anybody who is logged in to Discourse, and they can paste it in their browser address bar (without even opening Discourse) and download the file.
This feature only works with s3 and it is unclear if you have it enabled or not?
Yes, S3 is enabled. Otherwise I wouldn’t be able to use “Secure Media”.
Well I recommend you test this a lot more carefully, post an image in a pm and notice how end users without access to the pm do not have access
If logged in users have access to the post with the pdf they can download it
ah, that is a good point. I will test it right away.
EDIT: Ok apologies, you are right, only users with access to the post can download the media. Still, it is not limited to actually clicking on the post link, so given that the link was copied, and the user has access to to original media - I still think it should allow to download it without forcing the user to copy-paste the URL to his address bar
I will try to take a look at this for you this week, thanks for the report.
Sorry for the delay, this is fixed by FIX: Add secure media url to SERVER_SIDE_ONLY list by martin-brennan · Pull Request #11348 · discourse/discourse · GitHub