As designed $showDateLimitDisabler should be bound to a permission or setting

[nocte]

Affected version

2.1.7

In order to not kill the database servers on installations with large galleries, there's the admin option xfmgMediaIndexLimit ("Only show media added within the last X days"; unfortunately value is not kept on upgrade from XF1).

But there is a link with anchor text "Show older items" on the last page of the (limited) media index. Unfortunately there is no way to limit who can see/use this link, that adds the no_date_limit=1 parameter to the url. There's the template variable $showDateLimitDisabler, but it does not ask for permission. So people can kill your database servers though..

 

[Chris D]

We think it's important that people can access older media if they wish to.

If you are experiencing issues with people trying to use this maliciously, then they should be dealt with in the appropriate way but, for now, this is working as designed with no further changes planned.

(The forum date limit works the same way FWIW).