Anonyme Benutzer vom Ansehen von Bild- und Date-URLs ausschließen

Merkmal
21

Wonderful!

@mbcahyono could you please create a new topic for the plugin in plugin?

3 „Gefällt mir“
22

The Discourse Images Guardian plugin no longer works with the latest Discourse beta — you can’t set a URL for the logos any more so all images now require authentication, this results in the site logos returning 404’s for non-authenticated users, I have opened an issue for this on GitHub to see if we can find a way to solve this.

23

The Discourse Images Guardian has been updated by @mbcahyono so it now works with the latest Discourse beta, I have deployed it to a couple of servers running v2.3.0.beta1 :slight_smile:.

4 „Gefällt mir“
24

The Discourse Images Guardian plugin doesn’t currently work with the latest Discourse v2.3.0.beta5, I have had to disable it on a couple of sites. I have raised an issue for this on GitHub and hopefully @mbcahyono will have a suggestion for a fix for this soon.

2 „Gefällt mir“
25

Today we began internally trialling a new “secure media” setting, which is only usable if S3 uploads are enabled. What this will do is the following:

  • For Discourse instances that have the “login required” setting enabled, all uploads are considered secure, but if the setting is not enabled, only private message uploads are considered secure.
  • All securely uploaded media URLs within posts and private messages will no longer directly point to the file, but will go through an endpoint to determine access to the media first based on site settings.
  • Secure media in emails are replaced by placeholder text prompting users to log in to the Discourse instance to view the media.
  • If an upload has been used in a secure context previously, we do not allow posting the same upload in a public topic.

This setting is currently only available for self-hosted Discourse instances. We will provide further updates once we have completed internal trials.

14 „Gefällt mir“
26

What are the downsides of this? Does it effect performance at all?

27

The URL for media in posts/private messages is simply replaced with a Discourse server URL which then serves the private S3 URL for the upload.

2 „Gefällt mir“
28

Just to clarify here.

The downside is that you can not use a CDN anymore for private stuff and every image request / download has to “pipe” through the app to unlock the bucket for a user.

On small internal forums it is very unlikely you will notice anything. On a huge forums that require login, giving up the CDN and piping requests via the app may have some impact.

6 „Gefällt mir“
29

Das Image Guardian Plugin funktioniert nicht mit dem neuesten Discourse. Ich habe ein Issue auf GitHub dazu eröffnet:

Ich habe mir die Option “Sichere Uploads” angesehen, aber diese erfordert die Verwendung von S3, was im betreffenden Forum nicht der Fall ist. Daher wird sie immer noch benötigt und hoffentlich kann @mbcahyono dies lösen… :crossed_fingers:

30

@chrisc Es ist hier die Ferienzeit, also schaue ich nächste Woche danach :slight_smile:

1 „Gefällt mir“
31

Das ist erstaunlich, danke @mbcahyono, schöne Feiertage! :slight_smile:

32

@chrisc

Das sollte den Rebuild-Fehler beheben. Ich hatte noch keine Gelegenheit, die eigentliche Funktionalität zu testen.

1 „Gefällt mir“
33

Das ist fantastisch @mbcahyono Ich habe es installiert und getestet und es ist in Ordnung :slight_smile: nochmals vielen Dank!

1 „Gefällt mir“
34

@mbcahyono wäre es auch möglich, hochgeladene Benutzer-Avatar-Icons vor den Bildern zu schützen, für deren Anzeige ein Cookie erforderlich ist?

Diese haben URL-Pfade wie /user_avatar/$DOMAIN_NAME/$USER_NAME/$NUNBER/$ANOTHER_NUMBER.png.