Bug 461564 - Dolphin displays thumbnails of files without read access
Summary: Dolphin displays thumbnails of files without read access
Status: CONFIRMED
Alias: None
Product: dolphin
Classification: Applications
Component: view-engine: general (show other bugs)
Version: 19.12.3
Platform: Ubuntu Linux
: NOR major
Target Milestone: ---
Assignee: Dolphin Bug Assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-11-07 23:09 UTC by genetin
Modified: 2025-02-08 01:36 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description genetin 2022-11-07 23:09:59 UTC
Dolphin displays thumbnails of files, even if you do not have read access to these files.
I set the severity of this bug to "major" because there is a security issue : the content of a file that is not readable mustn't be displayed.

STEPS TO REPRODUCE
1. Create a file "a.jpg" and display its thumbnail in Dolphin
2. chmod 0 a.jpg
3. Refresh Dolphin display (or even quit Dolphin and restart it)

OBSERVED RESULT
The thumbnail of a.jpg is still displayed (although you have no right to see the content of the file).

EXPECTED RESULT
No thumbnail should be displayed for files you are not allowed to read.
Comment 1 Dimitri 2025-01-05 14:39:51 UTC
I agree. And it's what is asked by the standard : "Programs should first check that the original image file is readable. If it is not, the program should not attempt to read a thumbnail from the cache, and it should not save any information in the cache (including "failed" thumbnails)."
https://specifications.freedesktop.org/thumbnail-spec/latest/thumbsave.html#id-1.7.7

This usually isn't a problem because having access to the thumbnail means that the user had access to the file before.
But it become an issue if someone try to save space by sharing the thumbnail folder between multiple people with different level of access.
Comment 2 Justin Zobel 2025-02-08 01:36:25 UTC
Can confirm that the thumbnail is still shown if there are no read permissions on the file.