Using Private Upload 5.x-1.0-rc2 and Comment Upload 5.x-0.1 there is a pretty serious issue: While attaching files into comment user does have "private" checkbox, but it does not have any effect - files do not get protected!

Basically user thinks that checking private-checkbox files are protected, but they are not. Files as just as unprotected as usual node attachments which user does not mark as protected.

There is also a feature request in Private Uploads: #197591: Add "private" checkbox on Comment Upload attachments to comments, but I'd like to see this issue solved either with just telling user about this or removing checkbox in comment upload (this issue also submitted to Private Uploads-module: #441258: Security issue with comment upload / private checkbox , since I have no idea which one of these wo modules should be take care of this).

Comments

netaustin’s picture

netaustin commented
Status: Active » Closed (won't fix)

This is an issue for Private Upload. If it can't be fixed there, I'd be responsive to a patch, but I'm not planning to do any work on the 5.x branch beyond patch review.