Monday, December 27, 2010

Securing the Redmine_S3 plugin

We run redmine internally here at Fuery Solutions. Redmine is a fantastic tool for managing software development projects.

One of the unfortunate "features" redmine has is the habit of storing uploaded files without any security, regardless of whether the system itself is password protected or not. The redmine s3 plugin echoes this habit, setting all uploaded documents to readable by the entire internet. Obviously, the URLs are somewhat obscure, but as the cliche goes, obscurity is not security.

Here are instructions for altering the plugin to use temporary authorized URLs. This effectively offloads the security requirements to Amazon's formidable infrastructure.

These instructions apply to:

  • Redmine 1.0.x
  • Redmine_S3 v 0.03
Files you'll be editing (where "redmine" is your rails application root):
  1. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/attachment_patch.rb
  2. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/attachments_controller_patch.rb
  3. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/connection.rb
First, we need to disable the "set newly uploaded files to be readable" command. This entails commenting a single line in attachment_patch.rb, on line 24:

#Private (not readable by everyone) is the default.
#RedmineS3::Connection.publicly_readable!(path_to_file)

This handles newly created files. Next, we need to add the capability to retrieve a URI with the AWS temporary authorization keys. The S3 lib the plugin uses actually contains theses goodies already, so we just need a wrapper function in connection.rb that uses the QueryStringAuthGenerator class. This function isn't as clean as it could be, but we threw this together in an hour. Add this function to the Connection class in connection.rb:


def self.private_uri(filepath)
 load_options unless @@access_key_id && @@secret_acces_key
 @@qs_conn = S3::QueryStringAuthGenerator.new(@@access_key_id, @@secret_acces_key, false) unless @@qs_conn
 @@qs_conn.get(bucket, filepath)
end


I added this on line 37, between the bucket and uri functions. You'll also, of course, need to initialize @@qs_conn by adding this at the beginning of the file (line 7 or so):


@@qs_conn = nil

Finally, we need to adjust the controller function that handles the response to the attachment GET requests themselves. Adjust attachments_controller_path.rb on line 23:

#Comment the current line 23.
#redirect_to("#{RedmineS3::Connection.uri/#{@attachment.path_to_file}") 
#New code
redirect_to("#{RedmineS3::Connection.private_uri(@attachment.path_to_file)}") 


Don't forget to restart your application after performing these changes. You'll also, of course, need to adjust the file settings in AWS for previously uploaded files. Although this new code works for viewing those files, the security settings ("visible to everyone") need to be reset manually.


59 comments:

  1. Thanks for the post!! that really helped me out.

    ReplyDelete
  2. inspiring information! I am looking forward to reading more from you!

    ReplyDelete
  3. Really its very good post.knowledge sharing is the optimum result of knowledge gaining.

    ReplyDelete
  4. Open application programming interfaces (APIs) provide a standard interface, allowing third parties to create plug-ins that interact with the host application. A stable API allows third-party plug-ins to continue to function as the original version changes and to extend the life-cycle of obsolete applications.

    Thanks
    Michael
    windows95 computer

    ReplyDelete
  5. I must say, This is just awesome. Keep it up

    ReplyDelete
  6. I feel really nice reading these articles I mean there are writers that can write good material. I appreciated your professional way of writing this post.
    http://williambleimeister.com/

    ReplyDelete
  7. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. informatica online training .

    ReplyDelete
  8. We will provide you thousands of subscribers at an affordable price. This is a whole new concept that will help you to quickly, easily and effectively build real YouTube subscribers. (Buy YouTube Subscribers) Videos with a good number of subscribers automatically attract other people to have a look at the video and like, comment or subscribe to it. - See more at: http://ourfollower.com/buy-youtube-subscribers/

    ReplyDelete
  9. Whether you need a handful of responsive subscribers added to your account, or a massive following, whether you want to promote a brand or yourself on buy youtube subscribers, we can help you out.

    ReplyDelete
  10. You are so awesome! I don't suppose I have read anything like this before.
    http://www.squidoo.com/appleaccessories555

    ReplyDelete
  11. I’m glad to read you again. Thanks for this post.
    Best for you Buddy! Merry Christmas
    Dont Forget see my website www.7liveasia.com

    ReplyDelete
  12. Hi, I am a ebay listing software as well as web developer provider and I like to read and write article or blogs, mainly I read all blogs, it is my habit to collect information where ever I can, it will never waste ,today I caught your nice blog and it is written nicely with good content.....I appreciate it....

    ReplyDelete
  13. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. PHP Online Training .

    ReplyDelete
  14. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. SAP ABAP ONLINE TRAINING.

    ReplyDelete
  15. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks

    alot. sas online training .

    ReplyDelete
  16. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. PHP Online Training .

    ReplyDelete
  17. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. QA Online Training .

    ReplyDelete
  18. Thank you provide valuable informations and iam seacrching same informations,and saved my time SAS Online Training

    ReplyDelete
  19. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. QTP Online Training .

    ReplyDelete
  20. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. Selenium ONLINE TRAINING.

    ReplyDelete
  21. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. Manual Testing ONLINE TRAINING.

    ReplyDelete
  22. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. QTP ONLINE TRAINING.

    ReplyDelete
  23. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. UFT Online Training .

    ReplyDelete
  24. This comment has been removed by the author.

    ReplyDelete
  25. Thanks for this insightful post! Find more details and masterpapers reviews http://www.whowritesbest.com/masterpapers-com-review/

    ReplyDelete
  26. This comment has been removed by the author.

    ReplyDelete
  27. Thank you! For short and comprehensive tutorial! You can try out this servcie http://samedayessay.co.uk/dissertations.

    ReplyDelete
  28. Thanks a lot for this redmine guide! Hello! Get your essay per click on this website http://valwriting.net/

    ReplyDelete

  29. Hi, this is Jack from Chennai. Your blog is really very informative. Thanks for sharing this informative blog. SAS is a comprehensive statistical software system which integrates utilities for storing, modifying, analyzing, and graphing data. If anyone want to know more details please visit fita academy.

    Regards..
    SAS Course in Chennai




    ReplyDelete
  30. Hello there!
    Are you looking for some information to write an essay about ? Here order essay writing
    you can let this task for experst!

    ReplyDelete
  31. Great ideas! Thank you for this informative and useful post. Check out this site link to get more information.

    ReplyDelete
  32. Nice article. Sometimes Students face with issues in a essay writing and best essay writers at the service.

    ReplyDelete
  33. It’s really amazing that we can record what our visitors do on our site. Thanks for sharing this awesome guide. I’m happy that I came across with your site this article is on point,thanks again and have a great day. Keep update more information..

    CCNA Training in Chennai

    ReplyDelete
  34. Wow amazing i saw the article with execution models you had posted. It was such informative.By explaining this type we can identify the concepts easily. So thank you for this sharing.

    Web Designing Training in Chennai Adyar

    ReplyDelete
  35. Great articles, first of all Thanks for writing such lovely Post! Earlier I thought that posts are the only most important thing on any blog. But here at Shoutmeloud I found how important other elements are for your blog.Keep update more posts..

    Online Training in Chennai

    ReplyDelete
  36. this is really too useful and have more ideas from yours. keep sharing many techniques. eagerly waiting for your new blog and useful information. keep doing more.
    Digital Marketing Company in Chennai
    Digital Marketing Services in Chennai

    ReplyDelete
  37. Provides great information about the concept.It helps an individual to gain knowledge on new techniques.Keep on giving this type of information.
    SEO Training in Chennai

    ReplyDelete
  38. I am good follower of your site. Daily i will refer your site for enhance my knowledge in the area of website designing. Toady you really taught me how to write good content for your site.Great jobs done by you.



    Informatica Training in chennai

    ReplyDelete
  39. Superb. I really enjoyed very much with this article here. Really it is an amazing article I had ever read. I hope it will help a lot for all. Thank you so much for this amazing posts and please keep update like this excellent article.thank you for sharing such a great blog with us. expecting for your.
    Digital Marketing Company in India

    ReplyDelete
  40. Thank you for sharing such a nice and interesting blog with us. Hope it might be much useful for
    us. keep on updating...!!
    seo company in india
    digital marketing
    company in india

    ReplyDelete
  41. Excellent post, some great resources. Styling your blog the right way is key. This information is impressive..I am inspired with your post writing style & how continuously you describe this topic. After reading your post,thanks for taking the time to discuss this, I feel happy about and I am eager to learn more about this topic.

    Sofa Cleaning Mumbai

    ReplyDelete
  42. This was a very interesting read! Lots of opinion and very


    good research to be shared! Good feedback from the online


    readers as well. I must commend the author and web designer

    ReplyDelete
  43. I agree we share this blog explains it's changed mind way of doing the business.We Providers this output of others sites.
    Digital Marketing Training in Chennai
    Digital Marketing Course in Chennai

    ReplyDelete
  44. Great and nice blog thanks sharing..I just want to say that all the information you have given here is awesome...
    Software Training institute in Velachery
    PHP Training in Velachery

    ReplyDelete
  45. Interesting blog which attracted me more.I hope you will post more update like this.
    Digital marketing company in Chennai

    ReplyDelete
  46. Thank you so much for posting like this. I enjoyed much more here. So please keep update like this.

    Medical Insurance Plans

    Health Insurance UAE

    Insurance Companies in Dubai

    ReplyDelete
  47. inspiring information! I am looking forward to reading more from you!
    PHP Training Institute in Chennai

    ReplyDelete