adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

when requesting an private id, the permalink is revealed #668

New Issue
Closed
opened 2026-10-05 00:10:26 +02:00 by adam · 4 comments
adam commented 2026-10-05 00:10:26 +02:00
Owner
Copy link
Copy source

see https://github.com/Piwigo/Piwigo/issues/721

see https://github.com/Piwigo/Piwigo/issues/721 <!-- github-sync-id:239309098 -->
adam closed this issue 2026-10-05 00:10:26 +02:00
adam commented 2026-10-05 00:10:27 +02:00
Author
Owner
Copy link
Copy source

That's a bug ,right ? when requesting an private id , It Should not Disclosure anything about private album .
that's what private define for . Just Response status code "404" ,never let others know the private album exist.

That's a bug ,right ? when requesting an private id , It Should not Disclosure anything about private album . that's what private define for . Just Response status code "404" ,never let others know the private album exist. <!-- github-comment-id:311853398 -->
adam commented 2026-10-05 00:10:27 +02:00
Author
Owner
Copy link
Copy source

about the response code that's not that easy since each type of user users (legitimate ones, administrators, webmaster, uploaders and the ones who really shouldn't get the content) have reasons to know that an album they are trying to reach is forbidden. We could add a local config to change to a 404 but I think a gallery willing to have such a level a privacy would just make a custom plugin to tweak that and numerous other details.

However, what is wrong -and is the goal of the current ticket- is disclosing the permalink which contains an info about the potential content.

about the response code that's not that easy since each type of user users (legitimate ones, administrators, webmaster, uploaders and the ones who really shouldn't get the content) have reasons to know that an album they are trying to reach is forbidden. We could add a local config to change to a 404 but I think a gallery willing to have such a level a privacy would just make a custom plugin to tweak that and numerous other details. However, what is wrong -and is the goal of the current ticket- is disclosing the permalink which contains an info about the potential content. <!-- github-comment-id:311909390 -->
adam commented 2026-10-05 00:10:28 +02:00
Author
Owner
Copy link
Copy source

CVE-2017-10679 has been assigned for this issue.

CVE-2017-10679 has been assigned for this issue. <!-- github-comment-id:312419013 -->
adam commented 2026-10-05 00:10:29 +02:00
Author
Owner
Copy link
Copy source

master : https://github.com/Piwigo/Piwigo/commit/c4af38fe48f4d8f0853144fd8d13bc501e27d7ef
2.9 : https://github.com/Piwigo/Piwigo/commit/6530720d5112fb9a99fe3f3b7c3b8bd720774fd2

master : https://github.com/Piwigo/Piwigo/commit/c4af38fe48f4d8f0853144fd8d13bc501e27d7ef 2.9 : https://github.com/Piwigo/Piwigo/commit/6530720d5112fb9a99fe3f3b7c3b8bd720774fd2 <!-- github-comment-id:330484584 -->
adam changed title from when requesting an private id, the permalink is revealed to when requesting an private id, the permalink is revealed 2026-10-27 11:07:59 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#668