mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
Make images and attachments non-public #468
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @tuaris on GitHub (Oct 11, 2017).
Desired Feature: Make images and attachments non-public.
Expected Behavior
Images should not be accessible when Bookstack is configured to require login to view content.
My proposed solution (keep in mind I know nothing about Laravel) is to create an image proxy that boots up a minimal version of the application (just enough) to get authentication functional. The image proxy would be used when Bookstack is configured to require login to view content. This would be transparent, meaning it can be enabled and disabled without having to modify existing content. Something (I think) can be achieved with URL re-writing.
Current Behavior
According to https://www.bookstackapp.com/docs/admin/security/ images are publicly accessible (for perfectly valid technical/performance reasons).
A user knowing a URL can view any image/attachment and could result in sensitive information being leaked.
Steps to Reproduce
Configure Bookstack to require login when viewing content, copy the URL of an image, open a new private/incognito browser window. Image is visible.
@ssddanbrown commented on GitHub (Jan 12, 2018):
Just to confirm on this, Attachments are handled differently and, as long as your BookStack instance is set-up properly, they should not be publicly-accessible unlike images.
@ssddanbrown commented on GitHub (Jan 13, 2018):
Potential solution started in #665
@ssddanbrown commented on GitHub (Feb 11, 2018):
Potential solution deployed as part of v0.20.0, Details can be found in blog post:
https://www.bookstackapp.com/blog/beta-release-v0-20-0/
Leaving this open for feedback purposes.
@svarlamov commented on GitHub (Mar 20, 2018):
Is there a plan to have this feature setup with S3 via URL signing/proxy?
@ssddanbrown commented on GitHub (Mar 24, 2018):
@svarlamov Not at the moment but feel free to open an issue if that's a feature you want.
@ssddanbrown commented on GitHub (Mar 24, 2018):
Closing this now that the feature has made release, Feel free to open new issues for any image-auth related problems.