DemocracyLab / DemocracyLab/CivicTechExchange

Change S3 uploads to not have usernames in the file path

Open
#838 0 comments 0 reactions 1 assignee Claimed by @yiyichu View on GitHub
Back End python
Dominant language
JavaScript
Stars
105
Forks
71
PR merge metrics
No merged PRs in 30d

Description

Right now, any user-uploaded file to our S3 bucket has their username (which is their email address) in the path, e.g. `\thumbnails\myname@domain.com\filename.file_id.jpg` Rather than exposing email addresses this way, we should update our S3 uploader to use a unique identifier of some type which is not a plaintext username and we should make sure to update all our existing uploads without losing or breaking existing uploads. These include project files, project logo images, user profile images -- basically any file uploaded to dlab by a user.

In sum, this issue requires:
- a unique ID system which is not personal information
- changing our uploader to use that unique ID
- migrating all our old files to new links without breaking

Relevant code:
- https://github.com/DemocracyLab/CivicTechExchange/blob/ff5cff73ec3c0432223a4cdd1dfef92a139b8cf2/civictechprojects/views.py#L731
- https://github.com/DemocracyLab/CivicTechExchange/blob/ff5cff73ec3c0432223a4cdd1dfef92a139b8cf2/common/helpers/s3.py
- #383 may be useful reference

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.