All video attachments are publicly accessible

It seems that all video attachments are stored in the data directory rather than in internal_data - which means that they are publicly accessible, even on a private forum, unlike photos or other attachments.

If someone was to extract the video URL from the page and send it to a 3rd party who does not have access to the forum, they would still be able to view the video.

Steps to reproduce:

1. in a forum that does not have public access, create a post with the following items...

Read more

Читать далее...