Fixed Media inside deleted category albums remain accessible by direct URL

M

mattrogowski

Well-known member
Licensed customer
Affected version
2.2.4
If you have an album in a category, both the album and the media will have category_id populated.

If you delete the album, the media inside is still accessible if you know the URL. I'm assuming that despite being in a category, if the containing album is deleted it wouldn't be desired to still view the media.

PHP: 
if ($this->category_id && $this->Category)
{
    $canView = $this->Category->canView($error);
}
else if ($this->album_id && $this->Album)
{
    $canView = $this->Album->canView($error);
}

should maybe be:

PHP: 
if ($this->category_id && $this->Category)
{
    $canView = $this->Category->canView($error);
}
if ($canView && $this->album_id && $this->Album)
{
    $canView = $this->Album->canView($error);
}

Or maybe cleaning it up some other way. Either way it needs to also check Album->canView as right now it's just going by the category permissions. The category is also an album category, so doesn't have media directly inside it.
 
Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XFMG release (2.3.14).

Change log:
Prevent unauthorized access to media in deleted or moderated albums (#2724)
Click to expand...
There may be a delay before changes are rolled out to the XenForo Community.
 
Back
Top Bottom