do not leak photos through photos#show