Opened 9 years ago

# anonymous user can't view unprotected image file without PROTECTED_VIEW permission

Reported by: Owned by: scarabx@… frayja normal ProtectedMacro major 0.11

### Description

On Trac 0.11.7, anonymous user cannot view Images linked to a file in the repository. I only got it working by giving the anonymous user the PROTECTED_VIEW permission but this defeats the purpose of having protected sections.

My wiki markup is below:

= Overview =
[[BR]]
Some Description

[[BR]]
= Development =
{{{
#!protected
* [wiki:TheIdea The Idea]
}}}
* [query:status=new|assigned|reopened Active Tickets]



### comment:1 follow-up:  2 Changed 9 years ago by anonymous

So you are saying that the image (code below) is not shown when the viewing user does not have the PROTECTED_VIEW permission? Even though the [[IMAGE...]] is outside the protected section?

[[Image(source:/docs/design/collage.jpg, link=, alt="", title="")]]


Can you check the same thing with an image directly from disk? For both a protected and a non-protected section. For example: put a file (image.jpg) in the trac/htdocs directory and try the following:

[[Image(//image.jpg)]]


### comment:2 in reply to:  1 Changed 9 years ago by anonymous

Yup, you understood correctly. When I try with an image from disk it works for both protected and unprotected! Sample below:

[[Image(htdocs:image.jpg)]]


So you are saying that the image (code below) is not shown when the viewing user does not have the PROTECTED_VIEW permission? Even though the [[IMAGE...]] is outside the protected section?

[[Image(source:/docs/design/collage.jpg, link=, alt="", title="")]]


Can you check the same thing with an image directly from disk? For both a protected and a non-protected section. For example: put a file (image.jpg) in the trac/htdocs directory and try the following:

[[Image(//image.jpg)]]


### Modify Ticket

Change Properties