Can download third-party media without authentication

Headline

Description

Conduit lets me see media uploaded from other media without authentication, even if they were sent after I updated to Conduit v0.10.4

For example, I can download an image uploaded to Conduit Lounge on July 3rd (which is after my Conduit update):

$ /proc/$(pgrep conduit)/exe --version
conduit 0.10.4
$ ls -l /proc/$(pgrep conduit)/exe
lrwxrwxrwx 1 conduit conduit 0 Jun 22 07:16 /proc/526/exe -> /home/conduit/conduit/target/release/conduit
$ curl -s https://conduit.trix.re/_matrix/media/v3/download/ahouansou.cz/OIhzargrJMFwiAC6sw576V9mX3Y20AlC | hexdump -C | head -n 1
00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|

System info

• Conduit Version: 0.104
• Database backend: Rockdb
• OS and version: Debian 12
• Installation method (binary, distro package, docker image, etc.): Git