immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

Shared video still can be downloaded even if not marked #4683

New Issue
Closed
opened 2026-02-05 10:47:24 +03:00 by OVERLORD · 6 comments
OVERLORD commented 2026-02-05 10:47:24 +03:00
Owner
Copy Link

Originally created by @Karmalakas on GitHub (Nov 4, 2024).

The bug

Shared video still can be downloaded even if marked to not allow downloads

The OS that Immich Server is running on

TrueNAS Scale

Version of Immich Server

1.119.1

Platform with the issue

  • Web

Reproduction steps

  1. Open video
  2. Click to share it
  3. Unchect "Show Metadata" ("Allow download" gets un-checked automatically)
  4. Create link
  5. Copy link
  6. Open in incognito
  7. Play video
  8. Click 3 dots on the bottom right of the player
  9. Click "Download"
  10. Full resolution video gets downloaded
Originally created by @Karmalakas on GitHub (Nov 4, 2024). ### The bug Shared video still can be downloaded even if marked to not allow downloads ### The OS that Immich Server is running on TrueNAS Scale ### Version of Immich Server 1.119.1 ### Platform with the issue - [X] Web ### Reproduction steps 1. Open video 2. Click to share it 3. Unchect "Show Metadata" ("Allow download" gets un-checked automatically) 4. Create link 5. Copy link 6. Open in incognito 7. Play video 8. Click 3 dots on the bottom right of the player 9. Click "Download" 10. Full resolution video gets downloaded
OVERLORD commented 2026-02-05 10:47:26 +03:00
Author
Owner
Copy Link

@bo0tzz commented on GitHub (Nov 4, 2024):

This is working as expected. The video file that's served is the transcoded video (unless you've disabled transcoding). The user needs to be served some file for them to look at, and they necessarily are able to save that as well, just like they could right click and save a photo on which you've disabled downloading.

@bo0tzz commented on GitHub (Nov 4, 2024): This is working as expected. The video file that's served is the transcoded video (unless you've disabled transcoding). The user needs to be served some file for them to look at, and they necessarily are able to save that as well, just like they could right click and save a photo on which you've disabled downloading.
OVERLORD commented 2026-02-05 10:47:26 +03:00
Author
Owner
Copy Link

@Karmalakas commented on GitHub (Nov 4, 2024):

@bo0tzz, I don't agree... If download is disabled, at least player controls should be hidden

<video controls autoplay controlsList="nodownload" oncontextmenu="return false;">
    <source src="PATH-TO-VIDEO.mp4" type="video/mp4" />
</video>

Yes, I understand that in the source there would still be an easy way to access the file, but in the front-end it should be hidden

@Karmalakas commented on GitHub (Nov 4, 2024): @bo0tzz, I don't agree... If download is disabled, at least player controls should be hidden ``` <video controls autoplay controlsList="nodownload" oncontextmenu="return false;"> <source src="PATH-TO-VIDEO.mp4" type="video/mp4" /> </video> ``` Yes, I understand that in the source there would still be an easy way to access the file, but in the front-end it should be hidden
OVERLORD commented 2026-02-05 10:47:28 +03:00
Author
Owner
Copy Link

@bo0tzz commented on GitHub (Nov 4, 2024):

Hiding the controls would prevent people from seeking etc, that doesn't seem like a viable option to me. In general, trying to prevent people from downloading this video is just theater. If you don't trust someone to that level, don't share the video with them at all.

@bo0tzz commented on GitHub (Nov 4, 2024): Hiding the controls would prevent people from seeking etc, that doesn't seem like a viable option to me. In general, trying to prevent people from downloading this video is just theater. If you don't trust someone to that level, don't share the video with them at all.
OVERLORD commented 2026-02-05 10:47:29 +03:00
Author
Owner
Copy Link

@Karmalakas commented on GitHub (Nov 4, 2024):

<video controls controlsList="nodownload" ...

This does NOT hide the controls. It only hides the download option from the 3-dot menu. My bad phrasing it poorly earlier

@Karmalakas commented on GitHub (Nov 4, 2024): ``` <video controls controlsList="nodownload" ... ``` This does NOT hide the controls. It only hides the download option from the 3-dot menu. My bad phrasing it poorly earlier
OVERLORD commented 2026-02-05 10:47:30 +03:00
Author
Owner
Copy Link

@bo0tzz commented on GitHub (Nov 5, 2024):

Even with nodownload set, right-clicking the image still gives you a "save video as" option, so it's pretty pointless.

@bo0tzz commented on GitHub (Nov 5, 2024): Even with nodownload set, right-clicking the image still gives you a "save video as" option, so it's pretty pointless.
OVERLORD commented 2026-02-05 10:47:31 +03:00
Author
Owner
Copy Link

@Karmalakas commented on GitHub (Nov 5, 2024):

That's why there's

oncontextmenu="return false;"
@Karmalakas commented on GitHub (Nov 5, 2024): That's why there's ``` oncontextmenu="return false;" ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#4683
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?