openphoto/frontend — Issue #333: Photo generation security concerns
Author: jmathai
Created: 2011-11-28 00:13:20+00:00
State: open

Per a comment in issue #332
https://github.com/openphoto/frontend/issues/332#issuecomment-2890512

@cedricbonhomme There are a couple constraints but your points are still valid.

1. If the photo is private then the viewer needs permission to access your photo to call that API.
1. Calling the `/photo/:id/view.json` with `returnSizes` does not generate any photos. It only returns URLs which will generate them if they don't already exist. More details: https://github.com/openphoto/frontend/blob/master/documentation/faq/PhotoGeneration.markdown

We should identify the different use cases and criteria. The basic list is.

1. The user is also the owner (all access)
1. A user is logged in and has access to a private photo (a lot of access)
1. A user is not logged in and viewing a public photo (little access)

There's probably a few others.