I'm confused by one thing. I found this awesome jpg checked in on the GitLab Django demo project: http://demo.gitlabhq.com/uploads/note/attachment/2449/687474... Seems like everything else on the demo repo requires me to log in but I can access this file without authorization... Why is that?
Found it in the Django demo project attachments tab: http://demo.gitlabhq.com/django/files which requires login.
It's gloriously ironic! A photo mocking Rails security attached to a private repo... that's not secure.
You are right that attachments are only hidden and not protected by default. GitLab uses the CarrierWave gem to store attachments and this defaults to a publicly accessible directory. You can configure the behaviour of the attachment in https://github.com/gitlabhq/gitlabhq/blob/master/app/models/...
Comments
I'm confused by one thing. I found this awesome jpg checked in on the GitLab Django demo project: http://demo.gitlabhq.com/uploads/note/attachment/2449/687474... Seems like everything else on the demo repo requires me to log in but I can access this file without authorization... Why is that? Found it in the Django demo project attachments tab: http://demo.gitlabhq.com/django/files which requires login.
It's gloriously ironic! A photo mocking Rails security attached to a private repo... that's not secure.
You are right that attachments are only hidden and not protected by default. GitLab uses the CarrierWave gem to store attachments and this defaults to a publicly accessible directory. You can configure the behaviour of the attachment in https://github.com/gitlabhq/gitlabhq/blob/master/app/models/...