Personal Message attachments accessible to unauthenticated users (missing auth check)

[merefield (Robert)]

Might be worth looking at:

Secure Uploads

Added in the Discourse 2.4 release in February is the Secure Uploads feature, which provides a higher degree of security for ALL uploads (images, video, audio, text, pdfs, zips, and others) within a Discourse instance. Prerequisites You must have S3 uploads enabled on your site, which needs the following settings to be filled: S3 access key id S3 secret access key S3 region S3 upload bucket You also must be using an S3 bucket that does not have a Public bucket policy, and you need to make su…