Private rooms information leak via URLs

[madduck]

I am sorry if this is a duplicate, I did try to look for open issues using all the usual keywords, but without success.

So we have a private room, and in it, we shared a semi-secret document (via upload). Circumstance had it that someone accidentally leaked the URL to the scan to another forum. He immediately noticed, but there was nothing we could do, AFAICT, for knowledge of the URL would allow anyone to download the scan. One doesn't even need to be logged in to Riot/Matrix, let alone be a member of the room.

This is bad, and I'd argue that media URLs should essentially default to 403s or 401s, unless credentials are provided and those would be enough to let you see the media in Riot.

[t3chguy]

Duplicate of https://github.com/matrix-org/matrix-doc/issues/701

[madduck]

Silly me, @t3chguy. Too early in the morning, and too few coffees, as to think this was in any way a UI problem. Sorry about that.