Do not let caches keep queued or hidden images.

display.php

@@ -59,7 +59,8 @@ function display_img($id) {
     $hidden = $is_admin ? "" : " AND hidden IS NOT TRUE";
   }
 
-  $query = "SELECT img, mime FROM $table WHERE 1 AND ID = ?".$hidden." LIMIT 0, 1";
+  $columns = $queue ? "img, mime" : "img, mime, hidden";
+  $query = "SELECT $columns FROM $table WHERE 1 AND ID = ?".$hidden." LIMIT 0, 1";
   $result = $db->execute_query($query, array((int)$id)) or db_fail();
 
   $row = $result->fetch_assoc();
@@ -78,6 +79,10 @@ function display_img($id) {
     header("Content-type: ".$info['mime']);
     header("Content-length: ".strlen($img_data));
     header("X-Content-Type-Options: nosniff");
+    // Only this session can see a queued or hidden image: no cache may keep it
+    if ($queue || !empty($row['hidden'])) {
+      header("Cache-Control: private, no-store");
+    }
     print $img_data;
 
   } else {