RocketChat / RocketChat/Rocket.Chat
[Feature] Protect uploads further
@rodrigok is already working on this.
Since Sep 1, 2017.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
When one would enable protected uploads, files would only be accessible to users while logged in. A flaw in this feature seems to be that any logged in user can download any file.
For instance: When a file is shared in a private channel, any other user who is not part of said private channel could access the file if they were to obtain the link.
This actually prevents me from using Rocket.Chat for the purpose I intended, for now. I hope you might be able to change the way this works in the future, so that uploads shared in private channels can only be downloaded by members of the channel in question.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.