Images don't require api_key

[Junglejim 385]

16 minutes ago, Luke said:

It doesn't relate. This topic is about downloading images from the server, not adding new ones. 

But since you're on the topic, the camera upload feature is off by default, users have to opt-in into it, they have to go through the permission request on the device so that the app can access the photos, and then they have to select what folders from the device they want to upload.  So it is the user's choice, and in the upcoming 4.8 server release, there is a new user permission for it to block the uploads from getting into the server.

That's good news for the 4.8 release!  But if the personal photos were not there to start with nobody could download them maliciously, do you understand what I'm getting at?

I know some people like the idea of hosting there personal photos with emby but I think it's a bad idea, There are so many other great options out there that do a better job.

 

Edited October 23, 2023 by Junglejim

[knsdiuah 0]

On 4.9.3.0 and images still don't require an API key.

[rechigo 364]

27 minutes ago, knsdiuah said:

On 4.9.3.0 and images still don't require an API key.

Just corroborating statements from the emby team here...

We were told on October 23rd of last year it would be "resolved in the next beta" after it started getting a decent bit traction on the forums and Reddit. Threats to report CVE and whatnot.

Then we were told on November 29th that they "needed more time"

After that on Dec 9, we were told it would be 1-2 builds away despite 3 beta builds coming out since then.

Since then, no comments from the team regarding this critical security flaw in their paid software. This needs to be fixed by the next stable build at the very least. Ridiculous. 

Edited February 1 by rechigo