Tickets :: Comment on [#5892] Linked attachment feature vulnerability

* Your Email Address
* Spam protection	Enter the letters below: .__ . .. .. .\ / \| \\| \|\|_/ \|__\| >< \|__/\|/\\|\| \\| \|/ \
Comment	>> Isn't the simplest answer here to just add an intermediate page? Make > >> it impossible to download a linked attachment directly - you have to > >> go to the page first, get a token that's valid for a few minutes, > >> make a POST request, etc., then you get the file. That way no jar: > >> link could link directly to a file. > > > > Sounds good.
Attachment
Watch this ticket