<p>In Craft 2, this is expected behavior.</p>

<p>In Craft 3, we "fixed" it by using an Asset's UID instead of its ID, which makes it harder to guess.</p>

CC BY-SA 3.0
2018-01-29T11:35:00.843Z
So in Craft 2 it is possible to see al the uploaded images without logging in and scale them to any size even so big PHP runs out of memory. This seems like a serious issue to me. 


Why doesn't Craft check if the user is logged in to the admin?
Koen Rijpstra
CC BY-SA 3.0
2018-01-29T22:23:09.640Z
For the next release asset thumbnails will only be generated on Control Panel requests by logged in users.  Going to go ahead and vote to close this as a bug.
Brad Bell
CC BY-SA 3.0
2018-01-26T19:48:07.827Z
2018-01-26T19:48:07.827Z
Brad Bell
<p>Should the <code>/admin/resources/assetthumbs/{assetid}/200</code> be accessible without being logged in?</p>

<p>I’ve just noticed I can access thumbnails that way, and with some fiddling even let it generate huge images for me</p>

<p>This is on v2.6.3002.</p>

CC BY-SA 3.0
2018-01-26T16:49:01.270Z
Is this on a local setup or live site? Any other details you could give us? What do your permissions look like?
Dan Zuzevich
CC BY-SA 3.0
2018-01-29T12:35:55.880Z
Local and live. This isn't permission related and affects all Craft 2 sites see answer below from Brad Bell.
Koen Rijpstra
<admin>
Admin resources are accessible without being logged in
# Admin resources are accessible without being logged in

(Asked by: username_0 on 2018-01-26)

Should the `/admin/resources/assetthumbs/{assetid}/200` be accessible without being logged in?

I’ve just noticed I can access thumbnails that way, and with some fiddling even let it generate huge images for me

This is on v2.6.3002.

**Tags:** admin
> **Comments:**
> **username_1**: Is this on a local setup or live site? Any other details you could give us? What do your permissions look like?  
> **username_0**: Local and live. This isn't permission related and affects all Craft 2 sites see answer below from Brad Bell.  

---

## 1 answers

### Answer by username_2 on 2018-01-26. Score: 1 | Accepted answer

In Craft 2, this is expected behavior.

In Craft 3, we "fixed" it by using an Asset's UID instead of its ID, which makes it harder to guess.

> **Comments:**
> **username_0**: So in Craft 2 it is possible to see al the uploaded images without logging in and scale them to any size even so big PHP runs out of memory. This seems like a serious issue to me.    Why doesn't Craft check if the user is logged in to the admin?  
> **username_2**: For the next release asset thumbnails will only be generated on Control Panel requests by logged in users.  Going to go ahead and vote to close this as a bug.  

---

