STEPS TO REPRODUCE:

  1. Create a gallery album
  2. Remove all access from "Everyone"
  3. Add access to a group
  4. Add an item to the gallery
  5. View the item
  6. Extract the URL to the image (in Firefox, right click the image and select "Copy image location")
    (You can confirm you have the correct URL by loading it into the browser)
  7. Log out (or use a different browser -- I installed Opera to test things such as this)
  8. Load the page indicated by the extracted URL

EXPECTED BEHAVIOR:

  • Access denied

OBSERVED BEHAVIOR:

  • The image is accessible from the anonymous session

ADDITIONAL NOTES:

Accessing the album/item via Gallery2 does not exhibit this problem. I only see it when accessing it via the Drupal gallery module.

Comments

Daniel Norton’s picture

Daniel Norton commented
Priority: Normal » Critical

Bumped priority to "critical", as this represents a security vulnerability.

crifi’s picture

crifi commented
Status: Active » Postponed (maintainer needs more info)

I tried to reproduce your issue and I can't confirm it. Following your steps I get the Drupal login form for the item, since I have no permission as anonymous user. This is the expected behavior.