Answers.Body: <p>In Craft 2, this is expected behavior.</p>
  
  <p>In Craft 3, we "fixed" it by using an Asset's UID instead of its ID, which makes it harder to guess.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-29T11:35:00.843Z
Answers.Text: So in Craft 2 it is possible to see al the uploaded images without logging in and scale them to any size even so big PHP runs out of memory. This seems like a serious issue to me. 
  
  
  Why doesn't Craft check if the user is logged in to the admin?
Answers.UserDisplayName: Koen Rijpstra
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-29T22:23:09.640Z
Answers.Text: For the next release asset thumbnails will only be generated on Control Panel requests by logged in users.  Going to go ahead and vote to close this as a bug.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-26T19:48:07.827Z
Answers.LastActivityDate: 2018-01-26T19:48:07.827Z
Answers.UserDisplayName: Brad Bell
Body: <p>Should the <code>/admin/resources/assetthumbs/{assetid}/200</code> be accessible without being logged in?</p>
  
  <p>I’ve just noticed I can access thumbnails that way, and with some fiddling even let it generate huge images for me</p>
  
  <p>This is on v2.6.3002.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-26T16:49:01.270Z
Comments.Text: Is this on a local setup or live site? Any other details you could give us? What do your permissions look like?
Comments.UserDisplayName: Dan Zuzevich
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-01-29T12:35:55.880Z
Comments.Text: Local and live. This isn't permission related and affects all Craft 2 sites see answer below from Brad Bell.
Comments.UserDisplayName: Koen Rijpstra
Tags: <admin>
Title: Admin resources are accessible without being logged in
ThreadText: # Admin resources are accessible without being logged in
  
  (Asked by: username_0 on 2018-01-26)
  
  Should the `/admin/resources/assetthumbs/{assetid}/200` be accessible without being logged in?
  
  I’ve just noticed I can access thumbnails that way, and with some fiddling even let it generate huge images for me
  
  This is on v2.6.3002.
  
  **Tags:** admin
  
  > **Comments:**
  > **username_1**: Is this on a local setup or live site? Any other details you could give us? What do your permissions look like?  
  > **username_0**: Local and live. This isn't permission related and affects all Craft 2 sites see answer below from username_2 username_2.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2018-01-26. Score: 1 | Accepted answer
  
  In Craft 2, this is expected behavior.
  
  In Craft 3, we "fixed" it by using an Asset's UID instead of its ID, which makes it harder to guess.
  
  > **Comments:**
  > **username_0**: So in Craft 2 it is possible to see al the uploaded images without logging in and scale them to any size even so big PHP runs out of memory. This seems like a serious issue to me.    Why doesn't Craft check if the user is logged in to the admin?  
  > **username_2**: For the next release asset thumbnails will only be generated on Control Panel requests by logged in users.  Going to go ahead and vote to close this as a bug.  
  
  ---
  
  