dgtlmoon / changedetection.io

The best and simplest free open source web page change detection, website watcher, restock monitor and notification service. Restock Monitor, change detection. Designed for simplicity - Simply monitor which websites had a text change for free. Free Open source web page change detection, Website defacement monitoring, Price change notification
https://changedetection.io
Apache License 2.0
17.3k stars 965 forks source link

[feature] view-only public interface #437

Closed mzltest closed 2 years ago

mzltest commented 2 years ago

Version and OS docker/latest Is your feature request related to a problem? Please describe. Not really.

Describe the solution you'd like A public page for viewing all monitor and diffs, probably one step further for #129 .

Describe the use-case and give concrete real-world examples For example, status pages have a public page that allows you to view the uptime without password,an admin can modify ping interval and other settings with an admin password.It would be great to implement this concept on change detection too.And it would be better if we can choose what is on public display.

Additional context Here is my suggestion as a complete noob: currently we have password protection that displays a password input box for guests,so this might can be taken advantage of.If monitors are identified by uuids then probably public links does not a complete rework (just use the current links for display,just block access for guests if not set to show in public),as uuids are usually not humanly guessable.And of course,if you like you can do the same action for non-exist and private monitors to prevent someone eventually end up guessing uuids but I think this is overkill.

dgtlmoon commented 2 years ago

yeah its a reasonable idea, if someone (you?) want to supply a PR with a test ofcourse

https://github.com/dgtlmoon/changedetection.io/blob/46c72a7fb31fce18644684ebe758421ed34c8d7d/changedetectionio/__init__.py#L254

I would write it the same way like the 'RSS access token' system, except the secret token would generated from the watch uuid and the sites secret, then you would access the page with ?token=xxxxxx

ofcourse probably needs some config option to turn this on (off by default) to be extra safe

I feel like someone else mentioned this in another issue previously

dgtlmoon commented 2 years ago

Duplicate of https://github.com/dgtlmoon/changedetection.io/issues/129