Display sizes above maximum set in gallery can be downloaded by just changing the URL

Oja

I discovered a major bug with the new display sizes. This is separate from the bug where smug mug randomly changed many of my galleries from X3 max to "all but original". But if a gallery is set to allow a max of X3 for example, you can still download larger sizes by just changing the URL. This used to not be possible before. For example on this image:
https://lagemaatphoto.smugmug.com/Landscapes/National-Parks/Rocky-Mountain-National-Park/Dream-Lake/i-MBzSSs6/A
I can click the sharing button and get link to the image:
https://photos.smugmug.com/Landscapes/National-Parks/Rocky-Mountain-National-Park/Dream-Lake/i-MBzSSs6/0/X3/DSC_5176-Edit-X3.jpg

If OI then copy and paste into a browser window I can just change the X3 to 4K for example and I will actually get a 3072 × 3840 image. This should NOT be possible! It doesn't matter whether I am logged on or what browser. It always works.

denisegoldberg

When I tried that on your site the size flipped to X4. Is that your current maximum for the sharing link you posted?

I wonder if the browser cache is remembering you as logged in. Do you still get access to the original image if you are logged out and you have cleared the browser cache?

Oja

I tried it even on a second browser (Chrome) where I am definitely not logged in and it just gave me the file:

The same on Firefox which I haven't opened in many months.

Oja

I checked and they are the 4K files!

Oja

Oh and I indeed set this gallery to X4 max after I discovered it was somehow changed to "all but original" from the original X3 max setting.

Oja

It doesn't do this on my other galleries now. This might be a CDN issue that will resolve itself over time.

leftquark

You are correct @Oja, it is a CDN caching issue that will be resolved in a bit of time. We do our best to flush the CDN cache so that your higher resolution images are not available in in some cases they will be. If someone tries accessing a larger size than is allowed, they'll be redirected to the Max Display Size.

Oja

Thanks!