Announcement

#1 2012-09-10 10:07:15

Kalle
Member
2012-08-17
89

Secure Images

There is a huge security issue that need to be closed.

Nobody without permission should has any access to the photos. But looks like, everybody how knows the direct URL can access to the image files. That's strange and a problem. Why Piwigo has an user authentification, if anybody with technical knowledge can access all photos.

The solution: Each photo view request should be done from the server by php, and with htaccess the direct access to the files can be limited to the application.

Offline

 

#2 2012-09-10 17:34:17

flop25
Piwigo Team
2006-07-06
6931

Re: Secure Images

Hello
it's not a security issue. With the new multisize generation, the parameter "View hD" which is now "View Original" needs to be rethink.
But to access to the pictures you need to know the file name and the folders name. So you need to access to the thumbnails : if you use the permission on user/group, then can't access to the album so they can't access. If you use privacy levels on pictures and you have incremental file names, they can access.
The biggest problem is about the access to the Original : as I said, it's new so it will change


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Offline

 

#3 2012-09-10 19:30:33

Kalle
Member
2012-08-17
89

Re: Secure Images

The problem is: People, who know the direct link of a picture, can give this link to other person, and they can view the picture without authentification. To solve this, you need to change the filename every day.

Or it must be send by php to the browser, without the orginal filename and and from a not directly accessable folder.

Offline

 

#4 2012-09-10 19:34:46

flop25
Piwigo Team
2006-07-06
6931

Re: Secure Images

WOW
This case is not even handle at all by major websites as Facebook!
I think this will never be handle by Piwigo. The user will always be able to send a picture he can access ; screenshot etc


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Offline

 

#5 2012-09-10 19:38:53

Kalle
Member
2012-08-17
89

Re: Secure Images

Yes, the user can send, but for that the user must first safe the file.

You told me about facebook, but did they show the foto of a private galerie? No, they don't.

Offline

 

#6 2012-09-10 19:41:27

flop25
Piwigo Team
2006-07-06
6931

Re: Secure Images

Kalle wrote:

You told me about facebook, but did they show the foto of a private galerie? No, they don't.

???
I have a private profile, all my pictures are private but my friends which have access to my photos can still copy/paste the url of the image!


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Offline

 

#7 2012-09-10 19:47:46

flop25
Piwigo Team
2006-07-06
6931

Re: Secure Images

https://fbcdn-sphotos-g-a.akamaihd.net/hphotos-ak-ash4/283494_2198191790579_164798_n.jpg is a picture of one my friend : as you can see you can access it !


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Offline

 

#8 2012-09-10 19:49:10

Kalle
Member
2012-08-17
89

Re: Secure Images

I'm sure, that your photos can't be viewed by people outside of facebook.

I did the test with the facebook pictures of a friend. Copy the link, logout from facebook and insert the link to the browser. You will get an error message.

Offline

 

#9 2012-09-10 19:51:03

flop25
Piwigo Team
2006-07-06
6931

Re: Secure Images

Kalle wrote:

I'm sure, that your photos can't be viewed by people outside of facebook.

I did the test with the facebook pictures of a friend. Copy the link, logout from facebook and insert the link to the browser. You will get an error message.

see the picture above ?


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Offline

 

#10 2012-09-10 19:56:05

Kalle
Member
2012-08-17
89

Re: Secure Images

ok, you win with the facebook - shit.

I know about other galerie software without this security hole. For example, with Gallery 3, that does not work. But I don't like the software because of other limitations.

Offline

 

#11 2012-10-22 00:49:12

jpope
Member
2012-10-22
1

Re: Secure Images

This is a huge privacy hole. If an album is set to private, nothing within the album should be visible. Period.

Maybe I just have a configuration issue but, the attitude that 'if Facebook allows it' is the goal for Piwigo, count it uninstalled from my server.

Thanks.

Last edited by jpope (2012-10-22 02:01:16)

Offline

 

#12 2012-10-22 11:08:18

mendip_discovery
Member
Mendip Hills, Somerset, UK
2012-05-19
89

Re: Secure Images

If a Album is set to private and has user access controls to control who can look at them then it is safe. If someone gives out the address to the Piwigo page for that image the image is still safe.

The problem begins when people give out the direct URL (address) for the image itself. This is not secure, but there is very little people can do about it. IIRC there was some .htaccess stuff that was written to make stuff more secure but the problem is that it didn't work correctly on some server set ups causing the site not to work.

If you ask someone might give you the details.

Jack
btw I think you will find Gallery has had the same issues and has tried to prevent it but its hard to do so effectively without breaking the website.

Offline

 

#13 2012-10-22 12:06:01

flop25
Piwigo Team
2006-07-06
6931

Re: Secure Images

@mendip_discovery thx for your great answer

the Facebook arguments is not an excuse. It's just to explain how the web is. A htaccess protection will be implemented but there can be side effect.


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Offline

 

#14 2012-10-22 12:55:47

Kalle
Member
2012-08-17
89

Re: Secure Images

Not all Gallery systems have this issue, i told an working example.

The function can be optional, and is only needed for private albums.

Offline

 

#15 2012-12-17 21:28:48

Kalle
Member
2012-08-17
89

Re: Secure Images

flop25 wrote:

A htaccess protection will be implemented but there can be side effect.

Is this feature planned for the next version?

To limit the side effects, you can make this feature optional.

Offline

 

Board footer

Powered by FluxBB

github twitter facebook google+ newsletter Donate Piwigo.org © 2002-2019 · Contact