Tickets :: Comment on [#5892] Linked attachment feature vulnerability

* Your Email Address
* Spam protection	Enter the letters below: .__..__ .__ . .. . \| \|[__)[__)\|\ \|\| \| \|__\|\| \\| \| \\|\|/\\|
Comment	> I have an alternate thought here than the secret id craziness, and > having to determine users by id and email address, which seems really > unworkable if you think about forwarding, aliases, and a bunch of > other stuff. My head spins. > > > > Isn't the simplest answer here to just add an intermediate page? Make > it impossible to download a linked attachment directly - you have to > go to the page first, get a token that's valid for a few minutes, > make a POST request, etc., then you get the file. That way no jar: > link could link directly to a file.
Attachment
Watch this ticket