Post B8MGuzMbIMuPf1f6Ke by ericteubert@chaos.social
 (DIR) More posts by ericteubert@chaos.social
 (DIR) Post #B8MF8vaTvpJM5xfpYm by MoritzGlantz@mastodon.social
       0 likes, 0 repeats
       
       @ericteubert Allowing the whole world to upload something on a server is a bad idea. Maybe I did not understand the problem properly, but maybe let the users decide if they want to make that risk, or probably serve big files.What I don’t understand is, why this can be triggered without any authentication? Could this be something that can be triggered by a cronjob or from within Wordpress and not allow access from everybody?
       
 (DIR) Post #B8MGuzMbIMuPf1f6Ke by ericteubert@chaos.social
       0 likes, 0 repeats
       
       @MoritzGlantz I built this specific feature over 10 years ago. I don’t know what young Eric was thinking, but I’d wager a little too naive. I don’t think I was aware I was enabling arbitrary image/file upload to anyone who looks close enough.I needed to scale all kinds of images (also for “retina” auto scaling or whatever that feature is called officially), so I guess a hex encoded source url seemed convenient. I just wasn’t aware I’m doing a very dumb thing.