/diagnostics is (partly) available even when not logged in

[LudovicRousseau]

Lychee version

7.8.2

Did you check the latest Lychee version?

Yes, I did

Which PHP version are you using?

PHP 8.5

Detailed description of the problem

If I go to the /diagnostics page I get some of the results. I get only the self-diagnostic but that may be too much.

For example go to: https://demo.lycheeorg.dev/diagnostics

I would expect to be redirected to the main gallery page like for the other "admin" URLs when not logged in.

Steps to reproduce the issue

1. go to https://demo.lycheeorg.dev/diagnostics
2. see the "Self-diagnosis" results

Diagnostics [REQUIRED]

I guess it works with any config.

Browser & System [REQUIRED]

Firefox on macOS

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.
• I understand that if I am requested to provide more information, I must do so within 14 days or the bug report will be closed.

[ildyria]

That is intended. :)

We documented it in our Security Policy:
https://github.com/LycheeOrg/Lychee/blob/master/SECURITY.md#about-the-apiv2diagnostics-endpoint

Its main goal is to allow users to easily diagnose issues with their Lychee installation even if they can't log in.

Notice that most of the information displayed there are also censored (e.g. the path).