search

learningequality / kolibri

Kolibri Learning Platform: the offline app for universal education
https://learningequality.org/kolibri/
MIT License
755 stars 637 forks source link

Broken features in cloud instances when depending on temp or uploaded files #9441

Open nucleogenesis opened 2 years ago

nucleogenesis commented 2 years ago

Observed behavior

On instances running in the cloud using BCK, Kolibri is unable to provide features that make use of temporary storage. Two examples were discovered by NCC testing on the Vodafone BCK pentesting instance.

1) Cannot upload a CSV to import users 2) When generating logs, the links to download the successfully generated logs returns 404

A path toward solving this will need to look into storing user uploaded files and pod-generated files in a GCS bucket and referencing that location rather than a local file system when generating or storing files.

Note there may be more instances where this is a problem and it should be considered for all future features in Kolibri that involve temporary file storage or user file uploads.

Expected behavior

All Kolibri features work in the cloud instances as expected.

User-facing consequences

Cloud Kolibri instances have broken features.

Steps to reproduce

Try a BCK-deployed Kolibri to generate logs or import users by CSV.

Context

Kolibri 0.15.2 BCK VF Pentesting instance

rtibbles commented 2 years ago

Note that I think the most sustainable way to do this would be to use a DjangoStorage class to handle any file uploads in Kolibri - then it can be swapped out for a different class that supports the appropriate backend for the environment.

This is similar to https://github.com/learningequality/kolibri/issues/5698, except that this is for all non-content file operations - we have worked around content in remote settings by not having to import content at all, which seems better!