• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

XF 1.4 Forum is private and not indexed

flowerpot132

Formerly mugtree
#1
Yet you can still get to images if you know the url.

So for example right click on a resource icon and you can copy the image url. Paste that into a browser and you can see the image, even when not logged into the forum.

Why is that? and how do you stop it please?

Thanks
 

Chris D

XenForo developer
Staff member
#2
It's impossible to prevent.

The files for those are stored directly on the file system so if you know the URL, you can access them. This applies to attachment thumbnails too.

This is different to full size images and attachments: these are URLs which are accessed through PHP code which does check permissions.
 

Brogan

XenForo moderator
Staff member
#3
If the image has been uploaded to a post in a private forum, only those with permission to access the forum will be able to view it.

Resource icons are not permission protected.
 

flowerpot132

Formerly mugtree
#4
Ok thanks. Where else are images or icons not permission protected please?

Also, come to think of it, any else not permission protected? Eg resources files url links maybe?
 

Chris D

XenForo developer
Staff member
#5
As mentioned above, it's generally just non-important stuff, e.g. avatars, attachment thumbnails and resource icons.

Everything else, resources, full size attachments etc. are not directly accessible on the file system and go through URLs which check permissions.