[bug]: Unauthorized Access to /uploads Exposing Images Publicly

[hadran9]

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

This issue requires urgent attention due to its potential security implications.

Upon navigating to the /upload endpoint, it has come to my attention that all images are publicly accessible without the necessity for user authentication.

The exposure of these images could potentially be linked to the public status of some projects, or it may be a default behavior across all Plane projects. This issue warrants immediate attention as it poses a significant information disclosure vulnerability.

This issue has been previously reported in issue #2252, dating back to September, but it appears to have been left unresolved.

Steps to reproduce

1. Navigate to the /upload endpoint.
2. Observe that all images are publicly accessible without the necessity for user authentication.

Browser

Google Chrome

Version

Self-hosted

[srinivaspendem]

Hi @hadran9, thank you for reporting this. We are already working on it as a priority. We will keep you posted on the update.

[pablohashescobar]

@hadran9, this has been fixed in the latest release. Let us know if you are still facing the issue.

[hadran9]

Hello @srinivaspendem and @pablohashescobar,
I appreciate your prompt responses. I didn't realize that this was addressed in the latest version. I'll update my clone of the plane and get back to you. However, wouldn't it be beneficial to close #2252 with a comment to prevent similar issues from being raised in the future?

[hadran9]

@srinivaspendem and @pablohashescobar,
I have successfully completed the upgrade and can confirm that the previous issue with exposed information at the /upload endpoint has been resolved.

However, during the upgrade, I encountered a new issue, as shown in the attached screenshot.

When attempting to open the image via its URL, I encountered the following:

This issue seems to affect only the old images. New images that I upload do not encounter this problem.

Could you please provide some insight into this? Should I create a new ticket for this issue?

[pablohashescobar]

@hadran9, this would be the images that were uploaded before you changed the WEB_URL. We are aware of this bug and working on a fix.

[hadran9]

@pablohashescobar Given that the current issue has been resolved, I will proceed to close it. However, is there any other open issues for the old images that are not functioning correctly after the upgrade?