A page picture narrower than the table is still served publicly #894

New issue

Closed

opened 2026-09-27 09:34:29 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-09-27 09:34:29 +00:00

Collaborator

This came out of reviewing lane 8 PR 5 (private files, W7).

image_service.upload_lore_image always writes a wiki page's picture to the public /media/lore/{entry_id}/image.* path, whatever the page's audience. For a GM-only page, or one visible only to a party or to chosen people, the picture is therefore reachable by anyone who has the URL, bypassing the page's audience, and it's cached publicly and immutably.

The entry id is a UUID, so this is hard to guess, but the URL works for anyone it's forwarded to, and it keeps working after the page's audience narrows.

Fix (§3.8): store the picture of any page whose audience is narrower than the table in the private subtree (media/private/...), and serve it through the same authorised X-Accel-Redirect route as attachments. When a page's audience changes, move the file between the public and private stores.

This came out of reviewing lane 8 PR 5 (private files, W7). `image_service.upload_lore_image` always writes a wiki page's picture to the public `/media/lore/{entry_id}/image.*` path, whatever the page's audience. For a GM-only page, or one visible only to a party or to chosen people, the picture is therefore reachable by anyone who has the URL, bypassing the page's audience, and it's cached publicly and immutably. The entry id is a UUID, so this is hard to guess, but the URL works for anyone it's forwarded to, and it keeps working after the page's audience narrows. **Fix (§3.8):** store the picture of any page whose audience is narrower than the table in the private subtree (`media/private/...`), and serve it through the same authorised X-Accel-Redirect route as attachments. When a page's audience changes, move the file between the public and private stores.