[issue2551345] Access to static files is not limited by origin

New submission from John Rouillard:

It appears that you can request a static file from a Roundup instance from any
web page. The origin (CSRF) and other checks are not applied.

Anti leeching can be implemented by a proxy server.

So not a major issue, but it would be nice to provide a native method to
prevent inline linking/leeching.

----------
components: Web interface
messages: 8027
nosy: rouilj
severity: normal
status: new
title: Access to static files is not limited by origin
type: behavior

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551345>
_________________________________________________