Attachments URL + authentication

[man-tax]

Hi everyone,

as it was mentioned in #3579, attachments being publicly accessible is a bug and supposed to be fixed. I'm curious as to when, as my files are still accessible by anyone. Or did I miss where to set permissions?

Also I'm having issues with the links to the attachments. I'm using the repeater block (data {{ repeater.table.attachment }}) for displaying links ({{ repeaterblock.attachment.url }}) to the attachments. It generates the syntax

...myserver/app/start#/prod-budi-app-assets/app_4a97fc30ea25466..., but they actually sit at
...myserver/prod-budi-app-assets/app_4a97fc30ea25466...

This makes them not accessible via my links. The links in the table builder, and if I place a table on my screens for example, work fine.

Thanks a lot!
Sebastian

[mjashanks]

Hi Sebastian.

I will followup on this one.

Regarding your binding issue. The URL returned from the binding is a relative one /prod-budi-app-assets/app_4a97fc30ea25466... meaning that your browser will automatically prepend the current domain or path to it.

In order to get this to work, your binding will need to be https://myserver{{ repeaterblock.attachment.0.url }} (I also added .0.url in there as I think you need that too).

[aowdnmp]

Still not addressed? I was trying to access an uploaded file URL and seems still publicly accessible. Am I missing something? Thanks

[mike12345567]

Still not addressed? I was trying to access an uploaded file URL and seems still publicly accessible. Am I missing something? Thanks

Hi @aowdnmp - the URLs returned with Budibase are pre-signed URLs from S3/MinIO depending on the environment - these will be publicly accessible while the URL is valid, but a different URL will be generated each time the attachments are fetched. The attachments are no longer publicly indexable in anyway.

[aowdnmp]

In my case, file is stored inside its own budibase db.
The link is kind of https://.....p.cloudfront.net/......... and seems not changing over time avene if I accessed it several times. Copying the link I can access the document from an in private browser session. Is there some known timers on this link expiration? The link I saved from several 4+ hrs ago seems still working publicly.
I'm new to budibase so I'm just experimenting. Thanks.

[mike12345567]

Hi @aowdnmp yes - it will keep using the same link for a session and that link will be valid in any browser for 24 hours.

[aowdnmp]

Ok, understood, so I will test it again tomorrow, now it's clear, thanks!