Overview
Secure Media Uploads is a feature that controls who can access files that have been uploaded to your Vanilla community.
- When the feature is enabled, uploaded files are protected so that only users who have the appropriate permissions can view and/or download them, even if someone obtains a direct link to the file.
- When the feature is not enabled, uploaded files are publicly accessible to anyone who has the URL, regardless of whether they have the appropriate permissions to view the content to which the file was attached.
How it works
When Secure Media Uploads is enabled, newly uploaded files are stored with access restrictions tied to the content they belong to. When a user tries to view or download a file, Vanilla checks their permissions in real time before serving the content.
This "access-security" feature is applicable to newly uploaded files only. Files that were uploaded before this feature was enabled remain publicly accessible and are not retroactively secured.
Files that are attached to content that is accessible by guests (i.e., "public" content) are treated as public and can be cached by your CDN or browser for up to one week for performance. Truly private files are never cached by the CDN.
CACHE DELAYS NOTE: If content is switched from public to private (for example, a post is moved to a restricted category), there may be up to a one-week delay before previously cached public file URLs stop working.
Private files are not affected by this.
Uploaded Files access
Access to a secure file is determined by what the file is attached to.
Content Type | Accessible to… |
|---|
Post or comment in a category | Users with permission to view discussions in that category |
Event or event comment in a category | Users with permission to view events in that category |
Report | Global moderators, or per-category moderators if the reported content is in a category |
Deleted post or comment | Global moderators, or per-category moderators if the deleted content was in a category |
Group icon or banner (public or private group) | Any user |
Group icon or banner (secret group) | Group moderators and members |
Group post, comment, and event (public group) | Any user |
Group post, comment, and event (private or secret group) | Group moderators and members |
Conversation message | Users who are part of that conversation, or conversation moderators |
Article | Users who can view the article |
NOTE: If Private Communities is enabled on your site, there is no publicly accessible content, so all uploaded files are treated as private.
Anti-virus scanning
When anti-virus scanning is enabled, uploaded files are automatically scanned before being made available. If a file is detected as malicious, the upload is rejected and the uploading user is notified.
Enable/disable Secure Media Uploads
Contact Vanilla Support to request that Secure Media Uploads be enabled in your Vanilla community.