immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 11 Packages Projects Releases 10 Wiki Activity

assets should not be viewable by other users #1029

New Issue
Closed
opened 2026-02-05 00:06:19 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-05 00:06:19 +03:00
Owner
Copy Link

Originally created by @uhthomas on GitHub (Jun 29, 2023).

The bug

@jrasm91 mentioned it may be possible for any other user on the Immich instance to view any file or thumbnail regardless of the owner. This obviously may be intentional for some cases like shared albums, but maybe not desirable otherwise.

The OS that Immich Server is running on

N/A

Version of Immich Server

v1.64.0

Version of Immich Mobile App

N/A

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

N/A

Your .env content

N/A

Reproduction steps

N/A

Additional information

No response

Originally created by @uhthomas on GitHub (Jun 29, 2023). ### The bug @jrasm91 mentioned it may be possible for any other user on the Immich instance to view any file or thumbnail regardless of the owner. This obviously may be intentional for some cases like shared albums, but maybe not desirable otherwise. ### The OS that Immich Server is running on N/A ### Version of Immich Server v1.64.0 ### Version of Immich Mobile App N/A ### Platform with the issue - [X] Server - [ ] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML N/A ``` ### Your .env content ```Shell N/A ``` ### Reproduction steps ```bash N/A ``` ### Additional information _No response_
OVERLORD added the 🗄️server label 2026-02-05 00:06:19 +03:00
OVERLORD commented 2026-02-05 00:06:26 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Sep 13, 2023):

Both the serve file and serve thumbnail endpoints for have await this.access.requirePermission checks now, so this should be resolved.

@jrasm91 commented on GitHub (Sep 13, 2023): Both the serve file and serve thumbnail endpoints for have `await this.access.requirePermission` checks now, so this should be resolved.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label 🗄️server
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#1029
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?