attachments authentication

[marco-santulli]

Hi,

for what I can see right now, attachments are accessible via a URL that is publicly exposed. I was expecting that URL to require authentication, but the attachment becomes publicly accessible with a URL of this type:

https://MYSERVER/prod-budi-app-assets/app_80a7651c53204a32894897bb39d7c615/attachments/a0b8a083-8604-4ef6-8714-7fe0829f1fc8.pdf

M

[mjashanks]

Hi @marco-santulli.

Thank you for reporting this. It's a bug. We will get it fixed asap.

[man-tax]

Hey, is there an update on this? I'm having the same issue #5514
Thanks!

[PekkaJalonen]

Is there any progress with this bug?

[stephlegrand]

Hi,

Actually I think that it is good that they can be made publicly accessible, for several reasons. Sometimes we want to show a user (who is not authenticated) their own documents, or in my case, I want to be able to download validated documents through a http request.

For what it's worth :)

[marco-santulli]

Hi Steph, you are right, but in that case it should be something you can chose like the rest of the areas of the application. In buddibase you can make some areas "public"

M

[mjashanks]

Agreed. Perfectly good use case Steph - however, if we support it, it should be explicit - like "Public - Available to anyone with the URL".

[stephlegrand]

Great 🥳 a public option would be perfect !

[legaljustus]

Hi! Wondering what the status is on this. I agree a public option would be great! The fact that all files are now stored on a publicly accessible URL is a big security risk

[dylanzan]

Where can I obtain the URL after uploading the file?