If a generated image node is unpublished the thumbnail for the image is still displayed on the parent post. When clicked on the (correct) Access Denied error is generated for the actual image node (unless you are using Lightbox2 - in that case the full size image is displayed as normal).

Marking as critical because this bug allows users to see content (the thumbnail) that may have been un-published for reasons such as inappropriateness.

Comments

killes@www.drop.org’s picture

killes@www.drop.org commented
Version: 5.x-1.1 » 6.x-1.x-dev
Status: Active » Postponed (maintainer needs more info)

What do you suggest that should happen when the image node is unpublished? Should the attachement be de-listed?

killes@www.drop.org’s picture

killes@www.drop.org commented
Priority: Critical » Normal
Status: Postponed (maintainer needs more info) » Fixed

I've implemented this, please test.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.