GitHub Community
Replies: 6 comments 9 replies
-
|
sensitive infos or images, if the link is already deleted, is hard to be guessed,
it's mentioned at the bottom, so I think, if ever there is that unintentional image upload, you need to contact them as for me, I'm really checking this several times before posting it |
Beta Was this translation helpful? Give feedback.
-
|
People upload images in good faith all the time not realizing that they might be breaching e.g. GDPR requirements. Such images will be visible in issues/pull requests etc. no matter that the URLs are hard to guess. Even if the images references are removed from the contents they are still lying waiting to found by a future security breach. Strictly then, as we have no way to audit the uploaded images, we have no way to ensure that we are GDPR compliant 🤷🏻♂️ |
Beta Was this translation helpful? Give feedback.
-
|
Hi All. Great work @mkyed with that topic. In my opinion the discussion about this is needed. It is not only about sent an issue/PR, but even just about an operation 'drag and drop' a file. I remember how was surprised when discovered that despite Cancel all changes, the file was still uploaded. No notification, no approve message. Only needed to drag and drop the item inside textarea. Typical two ways for this: I'm pretty sure that sooner or later it will be resolved. I created issue about missing note in docs. Best wishes, |
Beta Was this translation helpful? Give feedback.
-
|
It is also problematic that pasting an image into a file in a 'private' repository generates an image URL which is publicly accessible. https://user-images.githubusercontent.com/2499066/197930666-7bf6de17-29ad-4d16-8568-17f871edbfd7.png You can see that it loads when embedded below, despite being pasted into a private repository:
Users likely expect that if they are pasting into a file hosted in a private repository that the pasted image will also be private. |
Beta Was this translation helpful? Give feedback.
-
|
I just discovered this behavior today while trying to import issues from Redmine to github (we want to move from self-hosted stuff to cloud and evaluating various options). I could not believe it works this way... but it does. |
Beta Was this translation helpful? Give feedback.
-
|
https://avatars.githubusercontent.com/u/2499066 https://api.github.com/users/daviewales The numbers uniquely identify the GitHub account and stays the same even when you change username. For example, if you change your handle from daviewales to davidwhales, then 2499066+daviewales@users.noreply.github.com just becomes 2499066+davidwhales@users.noreply.github.com So any image you upload can be traced back to the account that uploaded the image. |
Beta Was this translation helpful? Give feedback.
-
|
Yesterday 2023-05-22 when I tested image attachment, the urls are of the form and visibility is dependent on repository setting I think. This was changed from the old behavior of fully public urls of the form which was the case as recent as 2023-02-01. As of today 2023-05-23 images seems to now be migrated to the form
Note the lack of file extension. Contrast that with the following format for other attachments EDIT: It seems that while the source link as-written in markdown is changed, the actual serving URL now are either |
Beta Was this translation helpful? Give feedback.
-
|
This one helped me . Thanks for this. |
Beta Was this translation helpful? Give feedback.
-
|
One of my repo is public, however the url of uploaded imgage in Discussions is |
Beta Was this translation helpful? Give feedback.
-
|
They should really implement something to list every uploaded image/file and be able to delete them. |
Beta Was this translation helpful? Give feedback.
-
|
While a feature to better review exiting images would be welcome, note that as of 2023-05-09 #54551 private repo attachements are no longer public so the problem is (somewhat) mitigated. |
Beta Was this translation helpful? Give feedback.
-
|
I accidentally upload an image file into my README using the drag and drop feature and now I can't find and delete it. Will GitHub keep my images in their server forever? I don't get it. |
Beta Was this translation helpful? Give feedback.
-
|
As far as I know, yes. |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
Hi all,
Undesirable stuff can easily get uploaded to user-images.githubusercontent.com by mistake when including images writing comments etc. on GitHub. While GitHub Support can help with deleting a specific image there is AFAIK no way to browse through all the images uploaded by our organisation's participants and remove the unwanted ones ourselves.
Am I the only one missing this feature? 😊
/mkyed
Beta Was this translation helpful? Give feedback.
All reactions