The discussion revolves around how short-urls for data extraction are generated. glorentz1 analyzed the code on GitHub and found that something is hashed and base62’d, but couldn’t determine what is initially hashed. pfaffman pointed out that the hash is based on the content of uploaded files, as seen in the Discourse code. glorentz1 aims to guess the endpoint of data extraction for a given user by determining the value of {something} in the URL /uploads/short-url/{something}.zip. However, pfaffman clarified that guessing the URL is not possible without knowing the file contents, and the only way to obtain the URL is to pull it from the post where the file was uploaded.
I have read the code in github and so far what I have been able to gather is that something is hashed and then base62’d. However, I haven’t been able, through my code analysis, to figure out what is initially hashed in the first place.
Can anyone shed a light, please?
What are you trying to do? Why do you care?
I think that this is your answer:
If you’re looking for the filename of uploads, it’s a hash of the content. It’s how to see that files are uploaded only once.
But knowing what you’re trying to accomplish would help get you an answer to whatever your question really is.
Thank you, Jay. I am trying to see if there would be a way to guess the endpoint of data extraction for a given user. When I request a data extraction I need to send a GET request to /uploads/short-url/{something}.zip. My goal is to find out whether there is a way to guess the value of {something} for a specific account.
You can’t guess the url unless you have the file, as the hash is based on the file contents.
How are people posting the data? You’ll need to pull it from the post where they uploaded it