tobocop2
commented
9 months ago @PupLukey lack of protection around static assets is a concern and I agree.
However, can you document and prove specifically the following:
Which allows the enumeration of media file urls even easier and ultimately results in all your data being stolen by some filthy guy like me.Without logging into the user's account, there is no way to enumerate media urls, especially if they are marked private.
You will see the following when making a request to the /media?author=
{
"count": 0,
"next": null,
"previous": null,
"results": []
}
PupLukey
flinthamm
In case that this behavior is actually intended by the devs, this issue becomes a feature request.
Description
In violation with the major benefit that this application claims to provide, control over your data, there are two entities being exposed:
The visibilty state
privateof a media object which can be set after uploading or by a default setting in the settings.py does only prevent the enumeration of urls (answer). And is also undesirable since you would probably want to share it with registered users. \ It does however not prevent anyone from downloading the files.This will be the case no matter if GLOBAL_LOGIN_REQUIRED is true or false. \ Also overriding the LOGIN_REQUIRED_IGNORE_PATHS as opposed to #418 doesn't seem to deny access for anonymous users. @masavini mentioned in the aforementioned issue that the api uses a different authentication system. I would be glad if anyone could elaborate on this.
It seems that the backend is intended to let the nginx webserver do the heavy lifting of transferring media files to keep resources free for new requests. That is probably why the default site configuration of the nginx points urls beginning with
/mediaandmedia/originalto directories on the filesystem.default config excerpt
``` location /media/original { alias /home/mediacms.io/mediacms/media_files/original; } location /media { alias /home/mediacms.io/mediacms/media_files ; add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'; add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range'; } ```While this seems to be a known practise I recommend implementing some form of authorization to at least protect files from anonymous users but better to perform actual checks if this specific user is allowed to access the requested media. \ (This is also feature I am missing: Grant permission to watch a private video on a user+video basis.) \
One possibility mentioned by other online sources like the nginx documentation would be to use the
X-Accelheaders more commonly known as X-Sendfile feature. \ Then the resource request of the media file would need to be run against the REST API and the api returns a status code of either 200 or 403 to indicate if permission is granted and append theX-Accel-Redirectheader with the media file path to the response. The API does not need to return the file itself (empty body). Nginx (or any other supporting webserver) intercepts responses with this header and either returns the file or an http error code depending on the status of the original response given by the REST API.I think my proposal is quite reasonable since this application relies on nginx anyways and it would need only medium size changes to be useful for private use. \ I suppose changes may include:
X-Accel-Redirectinternaldirective to media locationsTo Reproduce
Steps to reproduce the issue:
Expected behavior
A non logged in user should not be able to get information from the api or access media files from the webserver if the GLOBAL_LOGIN_REQUIRED flag is true.
Screenshots
No Screenshots provided
Environment / Setup
Additional context
curl /api/v1/media no auth
``` curl -v -X GET https://Final Words
I like your efforts to provide the world with software fundamental to the web. \ I would like to continue using your software if this issue was addressed. \ I have not spent nearly enough time in this repo to see every context or understand it entirely. It may be that I made assumptions on how things are intended or how they could be implemented which are just wrong. Feel free to correct me or clarify things to help improve this software.