Bug Temporary attachments should only be viewable by the session/user which adds them

[Xon]

XenForo implements temporary attachments without additional constraints to view them. This sadly can be exploited for spam:

BassMan said:
Or this one...

Upload images in the quick editor and never post a reply. Use the URL of those images in an email for various phishing attacks. The URL points to your forum (images are uploaded to your server).
Click to expand...

The only real solution is to lock viewing temporary attachments to the session which created them for guests, or for the logged in user.

Continue reading...