Secure access to images

[MikeKry]

I have made permission to ensure secure access to media files through AuthorizationHandler, but I have a problem, that images (resized and even not resized) are also stored in (is|ms|sm)-cache folders, which are publicly accessible.

I would like to ask, if there is any possibility to configure orchard to not store those cache files in wwwroot, or to ignore them from static file serving?

Thanks

[Skrypt]

The ImageSharp cache folders are hashed so it is unlikely that someone will be able to figure out the direct url.
As for the ms-cache folder this is an issue.

[MikeKry]

yes, image sharp is ok, but it would be better if it could not be accessed directly too.

[deanmarcussen]

See: #7272

[Skrypt]

We should create a PR for this.

[MikeKry]

I have similliar middleware as in mentioned ticket, but there is a problem with direct access to FS.

We can block it at server level for incoming requests, but that is not an ideal solution and I do not know if it would not break someting in OC.

Isn't it possible to move cache folders outside of wwwroot? e.g. to app_data?

[Skrypt]

I was thinking the same to be honest.