4 ms·
I'm confused by one thing. I found this awesome jpg checked in on the GitLab Django demo project: http://demo.gitlabhq.com/uploads/note/attachment/2449/687474
by potench 14y ago
I'm confused by one thing. I found this awesome jpg checked in on the GitLab Django demo project: http://demo.gitlabhq.com/uploads/note/attachment/2449/687474703a2f2f692e716b6d652e6d652f333667347a352e6a7067.jpg http://demo.gitlabhq.com/uploads/note/attachment/2449/687474... Seems like everything else on the demo repo requires me to log in but I can access this file without authorization... Why is that?
Found it in the Django demo project attachments tab: http://demo.gitlabhq.com/django/files http://demo.gitlabhq.com/django/files which requires login.
It's gloriously ironic! A photo mocking Rails security attached to a private repo... that's not secure.
- sytse 14y agoYou are right that attachments are only hidden and not protected by default. GitLab uses the CarrierWave gem to store attachments and this defaults to a publicly accessible directory. You can configure the behaviour of the attachment in https://github.com/gitlabhq/gitlabhq/blob/master/app/models/note.rb https://github.com/gitlabhq/gitlabhq/blob/master/app/models/...