mirror of
https://github.com/jellyfin/jellyfin.git
synced 2026-07-16 05:43:54 +03:00
All (raw) image endpoints in ImageByNameController, ImageController & RemoteImageController are unauthenticated #6957
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @felix920506 on GitHub (Apr 23, 2025).
split from #5415
This allows probing on whether a specific image exists on the server by guessing item id's (which can be done without too much trouble, as item ids are based on filepath and filename information) and then checking on what content (movies, series etc) exist on a given server, without having an account.
Potential fix: This is tricky, because the images are loaded by the browser itself, so currently no authentication is provided. Below I propose a new authentication mechanism which would also fix this issue, allowing these endpoints to be authenticated.