1. Have you installed the new JSF Mobile app? Check out all the details here.
    Dismiss Notice
  2. One account & one avatar for all of JSF. Unified login and profile. Forum alerts on the main site, and more. Check out the details here: Forum & main site unified account feature is live!
    Dismiss Notice

Media Privacy

Discussion in 'Technical' started by chicanerous, Apr 2, 2016.

  1. chicanerous

    chicanerous Elite Member
    Lifetime Platinum Member

    Joined:
    Feb 1, 2004
    Messages:
    16,381
    Likes Received:
    25
    Hi John,

    Just wondering if you've had time to go through any media security settings that might be offered on the new forums. Since the VIP area is private, it might make sense for images, etc. uploaded to threads there to be only accessible by other VIP members or at least logged-in ones.

    Just something I happened to notice while clicking around to see if my old photos were transferred successfully.

    New forums look great!

    Cheers!

    :quadzilla:
     
    John Stone likes this.
  2. John Stone

    John Stone Every day is Leg Day
    Staff Member Owner

    Joined:
    Jan 20, 2004
    Messages:
    20,921
    Likes Received:
    74
    Hey Chico! :quadzilla:

    Are you talking about the new Media feature of the forums? If so, when a member creates a new Media Gallery album, he or she has complete control over who can add items to the album, and who can view those items (owner only, people you follow, registered member, public and even certain individual members) . Of course members can create as many albums as they like, each with its own permissions. Media Gallery items can be inserted in posts.

    This may be a little confusing to those used to the old system, but the new Media Gallery is an adjunct feature. All JSF VIP members still have permission to attach images directly to posts if they like just like the old system--Media Gallery not required.

    Of course any public image in the media gallery can be shared by anyone in posts. Any single private Media Gallery item that the owner chooses to share can also be placed in posts.

    Hope this makes sense.

    :pillowfight:
     
  3. chicanerous

    chicanerous Elite Member
    Lifetime Platinum Member

    Joined:
    Feb 1, 2004
    Messages:
    16,381
    Likes Received:
    25
    Sure, that makes sense.

    I noticed, however, that, if I copy the URL for an image I've posted in a thread in the VIP forums (i.e. that was transferred from the old forums, not something I've set up in a gallery with the new forum) into a Chrome Incognito window (where I am not logged into the forum), I can access that image despite not being logged-in (or therefore able to access the VIP forums). I don't know how someone might get that image URL if they are not a VIP member, but it seemed like a potentially undesirable behavior for anyone that would be concerned about that if there was the expectation of privacy for VIP content in the old forums.

    Going forward, of course, it would be up to members to control the privacy of their new content using the features of the new forum, but maybe the default for old VIP content should be private if possible? Maybe images were always exposed on the old forum even if they were posted in the VIP section?
     
    #3 chicanerous, Apr 2, 2016
    Last edited: Apr 2, 2016
  4. John Stone

    John Stone Every day is Leg Day
    Staff Member Owner

    Joined:
    Jan 20, 2004
    Messages:
    20,921
    Likes Received:
    74
    Ah, I understand what you're saying now. Yeah, someone would have to know the exact URL of the image, which seems unlikely unless it were shared, but that's definitely not something that should be possible. Great catch. I suspect it's a bug, I'll report it to the developers and follow up when I know more.
     
  5. John Stone

    John Stone Every day is Leg Day
    Staff Member Owner

    Joined:
    Jan 20, 2004
    Messages:
    20,921
    Likes Received:
    74
    I heard back from the developers regarding this issue.

    Rather than paraphrase, here's the exact reply. Note that I was able to confirm that full sized images are indeed protected by the permission system. He makes a good point regarding the random thumbnail URL, which is essentially a very long password.

     
  6. chicanerous

    chicanerous Elite Member
    Lifetime Platinum Member

    Joined:
    Feb 1, 2004
    Messages:
    16,381
    Likes Received:
    25
    Thanks for checking up, John!
     
  7. John Stone

    John Stone Every day is Leg Day
    Staff Member Owner

    Joined:
    Jan 20, 2004
    Messages:
    20,921
    Likes Received:
    74
    My pleasure. Thank you for the astute findings. :)
     

Share This Page