Question

According to Django document: “it was common to place static assets in MEDIA_ROOT along with user-uploaded files, and serve them both at MEDIA_URL. “

Does that mean everyone could access other people’s uploaded files?
Isn’t it unsafe?

Answer 1

To answer your question: yes, this would allow everyone to access everybody’s uploaded files. And yes, this is a security risk.

As a general rule, sensitive files should never be served directly from the filesystem. As another rule, all files should be considered sensitive unless explicitly marked otherwise.

The origin of the MEDIA_ROOT and MEDIA_URL settings probably lie in Django’s history as a publishing platform. After all, your editors probably won’t mind if the pictures they add to articles can easily be found. But then again, pictures accompanying an article are usually non-sensitive.

To expand on your question: sensitive files should always be placed in a directory that is not directly accessible by the web server. Requesting those files should only be done through a view class or function, which can do some sensible access checking before serving the file.

Also, do not rely on obfuscation for sensitive files. For example, let’s use Paulo’s example (see other answer) to obfuscate photo albums. Now my pictures are stored like MEDIA_URL/A8FEB0993BED/P100001.JPG. If I share this link with someone else, they can easily try URLs like MEDIA_URL/A8FEB0993BED/P710032.JPG, basically allowing them to brute-force my entire photo album.