Protect Uploads - download should not be possible without logging in

[graywolf336]

Right now uploads to a Rocket.Chat instance are not protected, meaning anyone can download them without being authenticated. I feel this should be an admin option, to protect or not protect uploads and require an account to download them.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[geekgonecrazy]

Absolutely agree! Almost think it should just default to requiring authentication. Do we want an option? I guess it doesn't hurt...

[graywolf336]

That's what I'm thinking, protected status is enabled by default and admins have the option to allow anyone with a link to download them.

[geekgonecrazy]

Looks like this will involve modifying another meteor module: jalik:ufs and jalik:ufs-gridfs Maybe to let us pass in some middleware which we could use to check for a Meteor.userId()

[geekgonecrazy]

Disregard ;-)

https://github.com/jalik/jalik-ufs/#setting-permissions looks to be exactly what I was talking about

[gmsecrieru]

I have started working on this but could not find a way to detect if the request for the file is coming from an authenticated user. I wonder if that is related to the way the file endpoint is defined on jalik:ufs

Any pro-tips @RocketChat/owners ?

[GaWr26]

Is there any progress on this issue as it is crucial to our implementation? I tried disabling file upload in admin settings but with no effect. Still able to upload files when set to false..

[gmsecrieru]

@FlashGuy22 this should be ready by tomorrow.