Buy Hosting

Group level permissions for uploaded files?

Technical Support
  • Q

    There's some mention of this previously (at the bottom of: Re: Make uploaded files private...?.

    Basically is there any way to make uploaded files only accessible to members of a specific group? At the moment any registered user can access any uploaded file if they have the correct link.

    Using: NodeBB v1.11.0.

    Thanks

    1
  • Q

    Ah. This limitation is troubling me a lot....I'm surprised it doesn't trouble others...

    Guess I'll just start investigating how to implement it myself.

    Any pointers appreciated. 👍

    0
  • PitaJP

    You haven't really described how this would work. Who can view who's uploaded files? What happens when multiple groups are involved?

    0
  • Q

    @PitaJ

    No worries I can explain:

    I've set up a category (Data Technology Team) that I only want one group (NTG Data Tech Team) to access:

    Slide1.JPG

    I've set up permissions so only group members can access the private category:

    Slide2.JPG

    I've created a post in the private category and uploaded an image into that post:

    Slide3.JPG

    I can right click on that image and save a link to it's address:

    https://my.domain.name/assets/uploads/files/1445505755666-wa5_dsc30086.jpg

    If ANYBODY has that address they can access the picture.

    I'd like to be able to tell users that only group members can access that picture, even if an unauthorised person discovers a link to it.

    This extra level of security creates peace of mind when posting private material.

    I guess it would be nice to have an extra column in the privileges configuration panel that allows/disallows access to uploads associated with each category. That way you can control which group(s) or users can access them.

    (I noticed that the nodebb-plugin-poll adds an extra column in the privileges configuration section....maybe a plugin could solve this problem)

    Otherwise, everything is perfect!

    0
  • A

    @quokka @PitaJ
    I need exactly the same thing ! 😉

    0
  • Q

    @alfazaz

    Ah well. I guess we can assume that this isn't a problem for most. I'm going to stick with NodeBB for public facing posts (It is a forum after all).

    For sharing sensitive data I'm going to use other more secure platforms (Nextcloud).

    Good luck!

    0

Suggested Topics

  • Jeremy SnyderJ

    Invalid CSRF Token when Uploading File via REST API

    Moved Technical Support
    6
    1 Votes
    6 Posts
    637 Views
    Jeremy SnyderJ

    Finally getting back around to testing this, still not having much luck. After digging through a lot of the code, and reading through the unit tests for the /api/post/upload endpoint, a user is logged in first.

    I have been trying to do this with only an API token, as this process is loading data from another system. I really don't want to have to store a password in addition to an API token when doing my data load.

    I guess my next question is: Is /api/post/upload even usable without logging in with a username/password?

  • Teresa-Hale-DHQT

    NodeBB crashes when uploading images

    Technical Support
    7
    0 Votes
    7 Posts
    456 Views
    PitaJP

    Okay so just to confirm this is caused by an error in sharp, try creating a file called test-sharp.js in your nodebb directory with the following contents:

    'use strict'; const fs = require('fs/promises'); const sharp = require('sharp'); async function run() { const input = await fs.readFile('public/logo.png'); await sharp(input) .resize({ width: 100 }) .toFile('build/public/logo.png'); } run().then(() => {}, err => setTimeout(() => { throw err; }, 0));

    Then run it like node test-sharp.js. It should create the file build/public/logo.png. Check the exit code with echo $?.

  • B

    Moderator Permissions

    Technical Support
    5
    0 Votes
    5 Posts
    423 Views
    oplik0O

    It is actually planned:
    https://github.com/NodeBB/NodeBB/issues/5736
    Two of the permissions that are supposed to be split are Global account info access and
    Global user sessions access.
    Unfortunately, there seems to be no ETA, and the issue is from 2017, so it might take some time before it's added... But there is hope 🙂

  • A

    Access to files in public via absolute URLs

    Technical Support
    3
    0 Votes
    3 Posts
    1k Views
    teh_gT

    You could also just make a new location block that points to to .well-known location on your disk.

    I have my main forums (https://gamingexodus.com) under /var/www/nodebb/forums, and then have the https://gamingexodus.com/.well-known/stuff under /var/www/.well-known

  • D

    Emoji doesn't work - running "Update Files" from ACP results in "connection refused"

    Technical Support
    1
    0 Votes
    1 Posts
    758 Views
    D

    After installing NodeBB I've been trying to configure Emoji. I've installed nodebb-plugin-emoji-extended and nodebb-plugin-emoji-one through the admin interface and have also activated them. But in the front-end the smiley selection button above the messages box does not appear.

    I've tried running "Update Files" in the ACP, which doesn't seem to be working. Popping up the console, I see various errors stating "GET http://95.85.57.198:4567/socket.io/?EIO=3&transport=polling&t=LYgu_ke net::ERR_CONNECTION_REFUSED" (from acp.min.js?v=a114ca78-1b00-48b4-8cb1-6d5fb06836f3:5).

    Help would be much appreciated.

Copyright © 2023 NodeBB | Contributors