Hotlink prevention, security enhancement and feature addition via short url functionality
- Status
- Open
- Subject
- Hotlink prevention, security enhancement and feature addition via short url functionality
- Version
- 16.x
- Category
- Feature request
- Feature
- File Gallery (elFinder or standard UI)
- Resolution status
- New
- Submitted by
- Niel Hirjee
- Lastmod by
- Niel Hirjee
- Rating
- Description
Since the short Url feature is being added to Tiki, could it not be combined with file galleries such that a file in a gallery is linked or displayed by using a short Url instead of the file Id?
This will enhance security and add new functionality to Tiki. Currently the value of fileId is sequentially generated and is therefore predictable: visitors can easily scrape off files from a tiki install by using tiki_download and incrementing the value of fileId inside a loop. Additionally, files can be hotlinked.
To fortify tiki against this, all that needs to be done is to combine the new short Url functionality with file galleries: if plugin files is used with a parameter, say "mask" or "obfuscate", then the fileId will be substituted with a short code. For example, the user enters tiki-download_file.php?fileId=1 in the wiki text editor, just as before, but if the obfuscate="y" parameter is used then the html will show tiki-download_file.php?fileId=RandomShortURLhghhgfftrdfgnj
As an additional feature, if the duration (life / validity) of the short code can be user defined per gallery / file / plugin files parameter, then tiki-download_file.php?fileId=RandomShortURLhghhgfftrdfgnj will stop serving fileId=1 after that time. Tiki could then be made to serve content via perishable and non predictable file names - just like the big CDN companies such as Akamai do.
I imagine this would be fairly simple to implement and would add a very useful feature to Tiki.
For a simple implementation of this idea, see:
https://github.com/spatie/url-signer
- Importance
- 2
- Easy to solve?
- 8
- Priority
- 16
- Demonstrate Bug on Tiki 19+
-
This bug has been demonstrated on show2.tiki.org
Please demonstrate your bug on show2.tiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show2.tiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Demonstrate Bug (older Tiki versions)
-
This bug has been demonstrated on show.tikiwiki.org
Please demonstrate your bug on show.tikiwiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show.tikiwiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Ticket ID
- 6238
- Created
- Tuesday 10 January, 2017 21:56:49 UTC
by Niel Hirjee - LastModif
- Thursday 02 February, 2017 12:23:05 UTC