• Welcome to the Chevereto user community!

    Here users from all over the world gather around to learn the latest about Chevereto and contribute with ideas to improve the software.

    Please keep in mind:

    • This community is user driven. Be polite with other users.
    • We recommend purchasing a Chevereto license to participate in this community.
    • Purchase a Community Subscription to get even faster ticket response times.

Image path and names available for all

Status
Not open for further replies.
M

mthiel1

Chevereto Member
Images always have the same path.
How can I protect the images?
Theoretically, anyone can access all (even the private) images. He just has to try different names.
 
mthiel1 said:
Images always have the same path.
How can I protect the images?
Theoretically, anyone can access all (even the private) images. He just has to try different names.
Click to expand...

When you upload something as private the url generated is like /path/<random>.ext, now... the lenght of the random string is 8 chars I believe and for esch char you have 36 possible values (A-Z + 0-9) so the possibilities are absurd big. Is 36 pow 8 which is 2821109907456 possibilities. So you are telling me that it could be guessed? Ok, it could be guessed but the computing needed is huge. If every request takes you one second it will need near 90,000 years to complete, if you take 10 request per second it will take 9,000 years... Remember that the server watchdog will notice a permanent IP doing those queries....

The only way to make the pictures 100% private is by serving all the images using PHP which may cause a lot of issues because that will demand a lot of machine because every request wil be dynamic. I think that the easiest thing to do is raise the number chars to 16 or 32 so guess the filename will be truly impossible and it will take many times the age of the universe to complete.
 
ah i understand! so i have to set private before uploading or i have to set Image-Name to random...
thanks! thats ok
 
Status
Not open for further replies.
Back
Top