Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Protected medias are downloadable by anonymous users #340

Open
lucacolombo4 opened this issue Oct 26, 2022 · 0 comments
Open

Protected medias are downloadable by anonymous users #340

lucacolombo4 opened this issue Oct 26, 2022 · 0 comments

Comments

@lucacolombo4
Copy link

Q A
Bug? yes
New Feature? no
Bundle Version 2.5.0
Sulu Version 2.4.5
PHP Version 8.0.x

Hi,
we've tried to enable the option sulu_form.media.protected as described in the bundle's documentation (https://github.com/sulu/SuluFormBundle/blob/2.5/Resources/doc/dynamic.md#media-protection), but seems like that anonymous users are still able to download attachments uploaded into the sulu_form system collection.

We've tried to debug the ProtectedMediaSubscriber event subscriber and it appears to correctly redirect the user to the admin media download route, but it doesn't seem to verify if the user is logged in before allowing the download.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant