Redmine Attachment links take user outside Redmine to Amazon S3 Object URL

[ptomka]

When clicking on a Redmine attachment link the user is taken to the Amazon S3 Object URL.

Redmine Link

Amazon S3 Object URL

http://<redmine_site_address>/attachments/8

https://<bucket_name>.amazonaws.com/2020/04/

[KerberosMorphy]

Get the same observation, doesn't feel totally safe with this solution since I have to keep all attachments publics if I want them to be accessible.

EDIT: Found this PR #4 Who add Pre Signed URL, still pointing on external Object URL, but at least there's a private option.

EDIT2: Found a solution, you can show images directly in redmine by adding these line in amazon_s3/lib/amazon_s3/patches/attachments_controller.rb after line 27:

    elsif @attachment.is_image?
      render :action => 'image'