imbo/imbo — pull request #258 by christeredvartsen (2014-02-14 07:54:06+00:00)
Title: In special cases, access tokens can be bypassed

In a very special case, original images (as in images with no transformations) can be viewed without any access tokens.

If the server admin has configured the `Imbo\EventListener\AccessToken` event listener with a whitelist and/or a blacklist of transformations, requests against the image resource that does not include any transformations at all in the request is allowed.