DemocracyLab / DemocracyLab/CivicTechExchange
Change S3 uploads to not have usernames in the file path
- Dominant language
- JavaScript
- Stars
- 105
- Forks
- 71
- PR merge metrics
- No merged PRs in 30d
Description
Right now, any user-uploaded file to our S3 bucket has their username (which is their email address) in the path, e.g. `\thumbnails\myname@domain.com\filename.file_id.jpg` Rather than exposing email addresses this way, we should update our S3 uploader to use a unique identifier of some type which is not a plaintext username and we should make sure to update all our existing uploads without losing or breaking existing uploads. These include project files, project logo images, user profile images -- basically any file uploaded to dlab by a user.
In sum, this issue requires:
- a unique ID system which is not personal information
- changing our uploader to use that unique ID
- migrating all our old files to new links without breaking
Relevant code:
- https://github.com/DemocracyLab/CivicTechExchange/blob/ff5cff73ec3c0432223a4cdd1dfef92a139b8cf2/civictechprojects/views.py#L731
- https://github.com/DemocracyLab/CivicTechExchange/blob/ff5cff73ec3c0432223a4cdd1dfef92a139b8cf2/common/helpers/s3.py
- #383 may be useful reference
Contributor guide
Assessment
This issue has not been assessed yet.