Security Issue

[bspiller]

I just found out if I attach an image or text file or anyting to a news post in my news forum it links to the main site. Anyone not logged in is also able to download it. If you goto the actual forum and click the link, you are unable to download it if your logged out. It also does not show the correct file size on the main site. It comes up as 0 kb. IS there a fix for this so anybody can't just download news post attachments from the main site?

[Brian]

The attachments are handled through vBulletin, so there's no way you would have permission to download them from the CMPS and not from the forums.

[bspiller]

You sure? I attached a file and it was able to be downloaded via the CMPS but if you went to the post it wouldn't let you.

[Chuckie]

I am positive. CPMS permissions are derived from the vBulletin admincp settings.

[Brian]

Is it the site in your profile here that you're having this issue on? I just checked it, but I'm not seeing any attachments in your news posts.