immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 11 Packages Projects Releases 10 Wiki Activity

[BUG] Shared file security bug 1.81.1 #1431

New Issue
Closed
opened 2026-02-05 01:46:55 +03:00 by OVERLORD · 3 comments
OVERLORD commented 2026-02-05 01:46:55 +03:00
Owner
Copy Link

Originally created by @AlexanderIlyanok on GitHub (Oct 7, 2023).

The bug

I shared one MOV, selected not to show metadata. Instead of empty info, app show full path in my external library. See screenshot.
image

The OS that Immich Server is running on

Windows 10

Version of Immich Server

1.81.1

Version of Immich Mobile App

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

...
services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    command: ["start.sh", "immich"]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
      - d:/Photo:/mnt/media/archive:ro 

...
immich-microservices:
    container_name: immich_microservices
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.yml
    #   service: hwaccel
    command: ["start.sh", "microservices"]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
      - d:/Photo:/mnt/media/archive:ro

Your .env content

Default from release.

Reproduction steps

1. Set external library for some folder
2. Select MOV (may be any?) file to share
3. Turn off Show Metadata
4. Copy shared link and open somewhere
5. You will see, that full path of file is shown in info panel: "Metadata not loaded for /mnt/media/archive/2023/07/..../IMG_1888.MOV"

Additional information

Etnoy comfired bug. https://discord.com/channels/979116623879368755/1159963526945849455

Originally created by @AlexanderIlyanok on GitHub (Oct 7, 2023). ### The bug I shared one MOV, selected not to show metadata. Instead of empty info, app show full path in my external library. See screenshot. ![image](https://github.com/immich-app/immich/assets/1693942/171a20cd-7fca-48ba-b243-814ed65cfb7c) ### The OS that Immich Server is running on Windows 10 ### Version of Immich Server 1.81.1 ### Version of Immich Mobile App - ### Platform with the issue - [X] Server - [X] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML ... services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} command: ["start.sh", "immich"] volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro - d:/Photo:/mnt/media/archive:ro ... immich-microservices: container_name: immich_microservices image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} # extends: # file: hwaccel.yml # service: hwaccel command: ["start.sh", "microservices"] volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro - d:/Photo:/mnt/media/archive:ro ``` ### Your .env content ```Shell Default from release. ``` ### Reproduction steps ```bash 1. Set external library for some folder 2. Select MOV (may be any?) file to share 3. Turn off Show Metadata 4. Copy shared link and open somewhere 5. You will see, that full path of file is shown in info panel: "Metadata not loaded for /mnt/media/archive/2023/07/..../IMG_1888.MOV" ``` ### Additional information Etnoy comfired bug. https://discord.com/channels/979116623879368755/1159963526945849455
OVERLORD added the 🗄️serverchangelog:security labels 2026-02-05 01:46:55 +03:00
OVERLORD commented 2026-02-05 01:47:01 +03:00
Author
Owner
Copy Link

@etnoy commented on GitHub (Oct 11, 2023):

I'm adding some context to the issue.

When sharing an album, you get the option to not show metadata:
image

However, the browser is still sent the full time bucket json which includes all metadata including location. It's not shown in the UI, but it's still sent to the browser.

If you click on download, you get the original image with all metadata including location.

If you right-click and download the thumbnail, you get a resized image, but still with all metadata including location.

@etnoy commented on GitHub (Oct 11, 2023): I'm adding some context to the issue. When sharing an album, you get the option to not show metadata: ![image](https://github.com/immich-app/immich/assets/135728/f8f9c29b-ccbf-4159-8206-44bdbaa54de4) However, the browser is still sent the full time bucket json which includes all metadata including location. It's not shown in the UI, but it's still sent to the browser. If you click on download, you get the original image with all metadata including location. If you right-click and download the thumbnail, you get a resized image, but still with all metadata including location.
OVERLORD commented 2026-02-05 01:47:12 +03:00
Author
Owner
Copy Link

@etnoy commented on GitHub (Oct 14, 2023):

Not done until we merge #4438

@etnoy commented on GitHub (Oct 14, 2023): Not done until we merge #4438
OVERLORD commented 2026-02-05 01:47:16 +03:00
Author
Owner
Copy Link

@mertalev commented on GitHub (Jan 29, 2024):

This issue is now fixed

@mertalev commented on GitHub (Jan 29, 2024): This issue is now fixed
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label changelog:security 🗄️server
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#1431
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?