Prevent deep linking to media files #376

New issue

Closed

opened 2021-02-14 22:04:43 +01:00 by nik · 11 comments

nik commented

2021-02-14 22:04:43 +01:00

Owner

Files in /media/ are generally world-readable if their URL is known. We must prevent this, as it might contain sensitive data (like person photos).

There are several options, of which we should chosoe a godo combination:

Securing the storage with content hashes/salts/HMAC/etc. in the file and directory names themselves to prevent guessing
Tie access to code logic that checks access to the model the file is related to
Use django-sendfile to serve media files from a frontend webserver but still retain privilege control inside AlekSIS

Files in `/media/` are generally world-readable if their URL is known. We must prevent this, as it might contain sensitive data (like person photos). There are several options, of which we should chosoe a godo combination: * Securing the storage with content hashes/salts/HMAC/etc. in the file and directory names themselves to prevent guessing * Tie access to code logic that checks access to the model the file is related to * Use django-sendfile to serve media files from a frontend webserver but still retain privilege control inside AlekSIS

nik commented

2021-02-14 22:07:15 +01:00

Author

Owner

assigned to @debdolph

nik commented

2021-02-14 22:07:20 +01:00

Author

Owner

changed the description

nik commented

2021-03-30 12:48:37 +02:00

Author

Owner

mentioned in merge request !2109

nik commented

2021-04-03 23:04:52 +02:00

Author

Owner

There is a helpful library called django-private-storage. It supports secure file storage with a permission checker, for files linked to a model (by configuring a function that checks permissions before serving the file; we could write a check function that checks permissions on the parent_object that is conveniently passed to this function).

Maybe we can combine this with django-sendfile in some way (and find out whether uwsgi supports sendfile).

There is a helpful library called `django-private-storage`. It supports secure file storage with a permission checker, for files linked to a model (by configuring a function that checks permissions before serving the file; we could write a check function that checks permissions on the `parent_object` that is conveniently passed to this function). Maybe we can combine this with `django-sendfile` in some way (and find out whether `uwsgi` supports sendfile).