Should the /admin/resources/assetthumbs/{assetid}/200 be accessible without being logged in?

I’ve just noticed I can access thumbnails that way, and with some fiddling even let it generate huge images for me

This is on v2.6.3002.

  • Is this on a local setup or live site? Any other details you could give us? What do your permissions look like? Jan 26 '18 at 16:49
  • Local and live. This isn't permission related and affects all Craft 2 sites see answer below from Brad Bell.
    – K.Rijpstra
    Jan 29 '18 at 12:35

In Craft 2, this is expected behavior.

In Craft 3, we "fixed" it by using an Asset's UID instead of its ID, which makes it harder to guess.

  • So in Craft 2 it is possible to see al the uploaded images without logging in and scale them to any size even so big PHP runs out of memory. This seems like a serious issue to me. Why doesn't Craft check if the user is logged in to the admin?
    – K.Rijpstra
    Jan 29 '18 at 11:35
  • 1
    For the next release asset thumbnails will only be generated on Control Panel requests by logged in users. Going to go ahead and vote to close this as a bug.
    – Brad Bell
    Jan 29 '18 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.