Permissions failed while embeding pictures in posts

[Heffalump]

If a user changed an album for i.e. "owner only" and a picture from this album is embed in a post, it is visible for everyone, for guests, too.
Is it a bug? I think, if a user hide his pictures he do not want to show it in the posts.

Album permissions:






Visible picture for guests:

 

[Chris D]

When you edit that post, is the image in IMG tags or GALLERY tags?

If it is the path to the thumbnail in an IMG tag then this is expected. Thumbnails don't have any permission checks on them. And this is basically the same as attachments (if the thumbnail path was embedded in a post rather than an attach tag).

 

[Heffalump]

The Image is embedded like this:

[URL='http://www.domain.com/forum/galerie/blick-vom-tisch.141743/'][IMG]http://www.domain.com/forum/data/xengallery/138/138523-80e0463545f3b4b3c050e167c3ab9ea3.jpg[/IMG][/URL]

 

[Mike]

That is indeed the thumbnail being embedded directly.

 

[Chris D]

Yeah. So that's expected. It's best to use the GALLERY BB Code for sharing images. These do get permission checked.

 

[Heffalump]

Thanks guys,

than I will disable the direct embedding.

If a user delete the picture in the gallery, will it be remain in the post?
Or will this thumbnail be delete, too? (
http://www.domain.com/forum/data/xengallery/138/138523-80e0463545f3b4b3c050e167c3ab9ea3.jpg)

I'm asking, because the link would be survive and by klicking on it a server error 403 will be the result.