Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T27227, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 25227 - Hotlinks to files work for users who can't display the [restricted] file description

Summary:	Hotlinks to files work for users who can't display the [restricted] file desc...

Status: NEW Product: MediaWiki extensions Classification: Unclassified Component: SimpleSecurity (Other open bugs) Version: unspecified Hardware: All All Importance: Normal major (vote) Target Milestone: --- Assigned To: Aran URL: Whiteboard: Keywords: Depends on: Blocks:   Show dependency tree / graph		Reported: 2010-09-20 17:18 UTC by Nemo Modified: 2014-04-15 06:22 UTC (History) CC List: 2 users (show) federicoleva Platonides See Also: Web browser: --- Mobile Platform: --- Assignee Huggle Beta Tester: ---

Attachments Add an attachment (proposed patch, testcase, etc.)

Description Nemo 2010-09-20 17:18:47 UTC E.g. http://www.wikimedia.it/index.php/File:IntervisteMantova2010.mp3 is restricted (log: http://www.wikimedia.it/index.php?title=Speciale:Registri&page=File%3AIntervisteMantova2010.mp3 ) but you can still download it from even as a logged out user: http://www.wikimedia.it/images/IntervisteMantova2010.mp3 This should be the problem mentioned here: http://www.mediawiki.org/wiki/Extension_talk:SimpleSecurity#Security_bug_for_files Comment 1 Platonides 2013-04-02 17:38:36 UTC See http://www.mediawiki.org/wiki/Manual:Image_Authorization It can't work unless you're using img_auth.php Can you reproduce it when using img_auth.php in a recent version?