If it is public let EVERYONE see it just with the URL (without any restriction)

szabodanika / microbin

A secure, configurable file-sharing and URL shortening web app written in Rust.

https://microbin.eu

BSD 3-Clause "New" or "Revised" License

2.71k stars 172 forks source link

If it is public let EVERYONE see it just with the URL (without any restriction) #259

Open 9acca9 opened 7 months ago

9acca9 commented 7 months ago

Im using a user/password to dont let everyone use my microbin BUT i will like to share with other some paste that i made.

I will find useful if when the paste is set to "public" that anyone, even those that dont have access to the server can see it. I mean, if they have the link then they can see it, without the need for user/password to enter the site.

I understand that i could leave the site without user/password, accessible to anyone and put a password for my "secret" paste... but....... almost all my paste are secret and i just want to share a few, so...

Hope this is understood, i dont speak english.

pooh22 commented 6 months ago

I agree, creating a paste should (could) require a password (upload password), but once you get the URL, you should be able to read the contents unless it is encrypted with a password. All other restrictions should still apply (burn after reading, expire time).

I guess basic-authentication is not very useful for a pastebin type of service, which makes it a confusing option and it doesn't work for receivers of the URL, with whom you don't want to share your authentication.

My suggestion would be:

remove basic authentication entirely (I don't see a use case for it)
when set, use upload password to restrict adding paste's or uploaded files

Optionally, having user accounts with permissions to add pastes/uploads would be useful in more complicated setups.

SR-G commented 6 months ago

Same use case for me. I'm surprised this is not the default behavior indeed. I would like :

All URLs to be password protected ("/admin", "/", "/list")
EXCEPT (at least) "/upload" and "/raw" = the one allowing to view the content of what has been uploaded

In order to have an instance "not usable by everyone" (but only usable by whoever has the password / is registered) but still to be able to have 100% public uploads.