search

rejetto / hfs

HFS is a web file server to run on your computer. Share folders or even a single file thanks to the virtual file system.
GNU General Public License v3.0
2.23k stars 222 forks source link

Direct link to access the file WITHOUT authorization #258

Open 6elkir opened 1 year ago

6elkir commented 1 year ago

Direct link to access the file WITHOUT authorization

https://docs.google.com/gview?url=https://share.dvor-net.ptz.ru/test.docx

I can attach unsupported files (such as docx, pptx, etc.) to the file viewer, but I need the ability to access the file via a direct link without request authorization. In order not to break security, I would use the Entry method to do getDirectLink() to get full links to a file on the server. There, of course, it is necessary to generate a certain token so that such files cannot be sorted out by brute force. In such cases, I could feed such links from the Google Docs viewer and they would return the content back to us for display, while directly forcing the file in advance without requesting it would be impossible.

Example: https://share.dvor-net.ptz.ru/E0RKlDhiPz.mp4

rejetto commented 1 year ago

i see. for this use case, the link needs to be valid for just a few seconds. This feature is useful for other use cases, not related to plugins, where you want to give access to a file to someone.

rejetto commented 1 year ago

did you consider that this method will actually give the file to google? users may not understand this, and just think you are displaying their file in the security of their personal server.

6elkir commented 1 year ago

did you consider that this method will actually give the file to google? users may not understand this, and just think you are displaying their file in the security of their personal server.

well, for example, google spreadsheet or google documents - a very safe way to display a file

rejetto commented 1 year ago

what you mean by "very safe" ? please re-read my comment. I said that it is not clear to your users that they are uploading their file to google. Google will have read their file, on their server. This is ok for me, maybe, but not for everyone. Did you consider this?

6elkir commented 1 year ago

I took it into account, but how do I know the files uploaded in this way to the Google server are not ubiquitous there, but are deleted after some time later. The idea with such access is that 1 - on a large number of volumes is not suitable, and hfs can thus transfer files to third-party services - the same sellers of electronic documents. Yes, I understand that this transfers files to an external service, but this is already digital technology. We are still writing non-file storage for the Pentagon)))

kam1kaze911 commented 11 months ago

I would also like a feature like this, but maybe it would be easier and perhaps safer to generate a custom token link to access a specific file one time only and after accessing for like just a few seconds, then delete the token.

The way via Google is no solution for self hosting files. Use Google drive instead then.