search

contao / image

Contao Image Library
12 stars 5 forks source link

Improve security of image filenames #87

Closed ausi closed 2 years ago

ausi commented 2 years ago

The paths for resized versions of private images should not be guessable for security reasons.

See contao/contao@9c517c7 (#3848)

ausi commented 2 years ago

Idea for better backwards compatibility:

Still calculate the old hash, and if the resized image already exists with the old name, return it. But if it does not exist, create a new image with the new hash algorithm instead.

leofeyer commented 2 years ago

Do we need backwards compatibility? We could also ask the users to rebuild their cache.

ausi commented 2 years ago

We could also ask the users to rebuild their cache.

This can be a very huge number of images that have to be regenerated. If the backwards compatibililty can be achieved without too much effort I would favor it.

ausi commented 2 years ago

Closed in favor of #90