Resource automatically followed when BB Code instructs browser to request `/download` path of a resource.


Well-known member
Affected version
Up until current one
Some bullet points that hopefully explain the issue:
  • One of the most visited pages of a XenForo installation might be the What's New page.
  • The Latest Profile Posts section allows use of BB Codes.
  • Admins and moderators who find themselves downloading a lot of resources (to make sure the community guidelines are being followed) usually enable a profile setting so that they do NOT automatically subscribe to / follow a resource upon download.
  • Image proxying doesn't work on same domain so the URL is loaded as is. The[IMG] tag runs the /download GET request successfully.
  • Lazy loading helps somehow with the issue, preventing the download until the IMG appears ini the visible viewport.
You can visit and view the BB Code of my post. Most users who will visit it will get subscribed to an unmaintained old version of a resource of mine. In the case I upload a new version for this resource, the users will be notified.