# Theme assets served from \`/uploads/\` break when “Prevent anons from downloading files” is enabled

**URL:** https://meta.discourse.org/t/theme-assets-served-from-uploads-break-when-prevent-anons-from-downloading-files-is-enabled/386380
**Category:** Bug
**Created:** [October 21, 2025, 11:12pm UTC](https://meta.discourse.org/t/theme-assets-served-from-uploads-break-when-prevent-anons-from-downloading-files-is-enabled/386380 "2025-10-21T23:12:21Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![lhkjacky](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lhkjacky/32/204198_2.png) [@lhkjacky](https://meta.discourse.org/u/lhkjacky)
#### Post date: [October 21, 2025, 11:12pm UTC](https://meta.discourse.org/t/theme-assets-served-from-uploads-break-when-prevent-anons-from-downloading-files-is-enabled/386380/1 "2025-10-21T23:12:21Z")

</div>

When a theme component declares assets in its `about.json`, Discourse stores and serves them under `/uploads/`.  
If the site setting **“Prevent anons from downloading files”** is enabled, these theme assets return `404` for anonymous users because they’re treated as protected uploads.  
This can break any theme or component that dynamically loads its own JavaScript — for example, the **Topic List Previews** component.

* * *

### **Steps to reproduce**

1. Install the **Topic List Previews** component (`https://github.com/merefield/discourse-tc-topic-list-previews`).
2. Verify it loads correctly for both logged-in and anonymous users.
3. Enable the site setting **Prevent anons from downloading files**.
4. Visit the forum homepage as a logged-out user and check the browser console.

* * *

### **Observed behavior**

- Requests for files such as

- Browser console shows:

- Components relying on that file (e.g., `preview-edits.gjs` in Topic List Previews) fail to run, causing layout issues.

* * *

### **Expected behavior**

Theme assets defined in `about.json` should always be **publicly accessible** , regardless of the “Prevent anons from downloading files” setting.  
They are static assets, not user uploads, and should not inherit upload-level access restrictions.

* * *

### **Technical details**

- Discourse version: 3.6.0.beta2 (latest)

- Component: [Topic List Previews](https://github.com/merefield/discourse-tc-topic-list-previews)

- Relevant `about.json` snippet:

- During theme installation, Discourse stores this file as an `Upload` under `/uploads/default/original/...`.

- Enabling the anon restriction causes Discourse to block requests for that path, even though it’s a theme asset.

* * *

### **Proposed resolution**

Theme assets uploaded via `about.json` should be:

- Served from a dedicated path (e.g., `/theme-assets/` or `/assets/`)  
**or**
- Exempted from the “Prevent anons from downloading files” restriction.

* * *

### **Impact**

This affects any theme or component that relies on theme assets (JS/CSS/images) dynamically loaded in the client.  
Breaks major UI components for anonymous visitors when the anon download restriction is turned on.

---

_[View the full topic](https://meta.discourse.org/t/theme-assets-served-from-uploads-break-when-prevent-anons-from-downloading-files-is-enabled/386380)._