Bug: We can access any uploaded media id

[altenterx]

Hi! Just found out accidentally that we can access any media_id uploaded to Twitter, is this bug?

I mistakenly failed to parse media_id and media_id_str, so when I try sending DM, I got wrong Image (first image)

I only uploaded the second image gif from picture below. I thought every media uploaded from API should have owner ID, isn’t it?

[andypiper]

Hi there!

Can you reproduce this? Recognise that this did happen for you. Are you able to share the media IDs for the two media in the situation you listed? We would of course like to investigate this but we have not been able to reproduce here so the more information you can share, the more we can dig in. Thanks!

[altenterx]

Hi! unfortunately I didn’t save the ID, but This is my code (written in Go)

	respMedia, _ := twtApi.UploadMediaChunked("storage/app/bp.gif", "image/gif")
	mediaId, _ := strconv.Atoi(respMedia.MediaIDString)

	params := twitter_structs.DirectMessageEventsNewParams{
		Event: &twitter_structs.DirectMessageEvent{
			Type: "message_create",
			MessageCreate: &twitter_structs.DirectMessageEventMessage{
				Target: &twitter_structs.DirectMessageTarget{
					RecipientID: "1171827585174528000",
				},
				MessageData: &twitter_structs.DirectMessageData{
					Text: "example yow cekedaw yo",
					Attachment: &twitter_structs.DirectMessageDataAttachment{
						Type: "media",
						Media: twitter_structs.EntityMedia{
							Id: int64(mediaId),
						},
					},
				},
			},
		},
	}

First time (wrong image) I put field MediaID (int64 type) to media struct
Take a look at this code:

Media: twitter_structs.EntityMedia{
           Id: respMedia.MediaID,
}

then I change my code to (right image):

mediaId, _ := strconv.Atoi(respMedia.MediaIDString)
//..
Media: twitter_structs.EntityMedia{
           Id: int64(mediaId),
}

Many thanks