Hello,

I'm trying to understand why there are a bunch of .js files with ugly, random filenames getting automatically generated in my /_data/combined/

The js code inside them is heavily obfuscated, with all whitespace removed!  Is that really necessary?  Does that removal of whitespace speed up downloads by a whopping 1%?  Can this dodgy-looking mechanism be explained, please?  When I see so-called "data" (which ends up being **code**, not data) which is *not* in the database, that to me is a red flag, since I would expect all "data" to be in the *database*, not out in the filesystem.  If it's some sort of cache, then perhaps the folder name "_data" should be renamed "cache"?

This obfuscated javascript code looks like a hacker's delight - it looks to me like a very juicy opportunity to hide malicious code there, and since it's not human readable, nobody would notice.

Please, assure me that the strange goings-on inside /_data/combined/ are somehow actually valuable.

Even if this mechanism is somehow unavoidable, according to your rationale, oh Piwigo devs, then I submit for your consideration an opportunity to harden up the security, of the slightly random filenames you are using within /_data/combined/.  The filenames are 7 characters (not including .js extensions), being either numbers, or lowercase letters.  This amount of randomness in your filenames is very low "entropy" (which is to say, the security is "Poor"), when measured by a password-testing utility such as KeepassXC:



If you were wanting instead an "Excellent" amount of entropy, then consider having 23-character filenames (not including .js extension):



Note: you can get away with "Excellent" entropy in 18-character filenames, if you would be willing to use a mixture of upper and lowercase characters:





    Piwigo 11.0.0 Check for upgrade
    Operating system: Linux
    PHP: 7.4.3 (Show info) [2021-01-20 08:51:27]
    MySQL: 5.5.5-10.3.25-MariaDB-0ubuntu0.20.04.1 [2021-01-20 08:51:27]
    Graphics Library: GD 2.2.5


Piwigo URL: http://

Last edited by esbeeb (2021-01-20 17:11:50)