Monday, December 27, 2010

Securing the Redmine_S3 plugin

We run redmine internally here at Fuery Solutions. Redmine is a fantastic tool for managing software development projects.

One of the unfortunate "features" redmine has is the habit of storing uploaded files without any security, regardless of whether the system itself is password protected or not. The redmine s3 plugin echoes this habit, setting all uploaded documents to readable by the entire internet. Obviously, the URLs are somewhat obscure, but as the cliche goes, obscurity is not security.

Here are instructions for altering the plugin to use temporary authorized URLs. This effectively offloads the security requirements to Amazon's formidable infrastructure.

These instructions apply to:

  • Redmine 1.0.x
  • Redmine_S3 v 0.03
Files you'll be editing (where "redmine" is your rails application root):
  1. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/attachment_patch.rb
  2. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/attachments_controller_patch.rb
  3. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/connection.rb
First, we need to disable the "set newly uploaded files to be readable" command. This entails commenting a single line in attachment_patch.rb, on line 24:

#Private (not readable by everyone) is the default.
#RedmineS3::Connection.publicly_readable!(path_to_file)

This handles newly created files. Next, we need to add the capability to retrieve a URI with the AWS temporary authorization keys. The S3 lib the plugin uses actually contains theses goodies already, so we just need a wrapper function in connection.rb that uses the QueryStringAuthGenerator class. This function isn't as clean as it could be, but we threw this together in an hour. Add this function to the Connection class in connection.rb:


def self.private_uri(filepath)
 load_options unless @@access_key_id && @@secret_acces_key
 @@qs_conn = S3::QueryStringAuthGenerator.new(@@access_key_id, @@secret_acces_key, false) unless @@qs_conn
 @@qs_conn.get(bucket, filepath)
end


I added this on line 37, between the bucket and uri functions. You'll also, of course, need to initialize @@qs_conn by adding this at the beginning of the file (line 7 or so):


@@qs_conn = nil

Finally, we need to adjust the controller function that handles the response to the attachment GET requests themselves. Adjust attachments_controller_path.rb on line 23:

#Comment the current line 23.
#redirect_to("#{RedmineS3::Connection.uri/#{@attachment.path_to_file}") 
#New code
redirect_to("#{RedmineS3::Connection.private_uri(@attachment.path_to_file)}") 


Don't forget to restart your application after performing these changes. You'll also, of course, need to adjust the file settings in AWS for previously uploaded files. Although this new code works for viewing those files, the security settings ("visible to everyone") need to be reset manually.


100 comments:

  1. Thanks for the post!! that really helped me out.

    ReplyDelete
    Replies
    1. Cyber Security Projects

      projects for cse

      Networking Projects

      JavaScript Training in Chennai

      JavaScript Training in Chennai

      The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

      Delete
  2. inspiring information! I am looking forward to reading more from you!

    ReplyDelete
  3. Really its very good post.knowledge sharing is the optimum result of knowledge gaining.

    ReplyDelete
  4. Open application programming interfaces (APIs) provide a standard interface, allowing third parties to create plug-ins that interact with the host application. A stable API allows third-party plug-ins to continue to function as the original version changes and to extend the life-cycle of obsolete applications.

    Thanks
    Michael
    windows95 computer

    ReplyDelete
  5. I must say, This is just awesome. Keep it up

    ReplyDelete
  6. I feel really nice reading these articles I mean there are writers that can write good material. I appreciated your professional way of writing this post.
    http://williambleimeister.com/

    ReplyDelete
  7. We will provide you thousands of subscribers at an affordable price. This is a whole new concept that will help you to quickly, easily and effectively build real YouTube subscribers. (Buy YouTube Subscribers) Videos with a good number of subscribers automatically attract other people to have a look at the video and like, comment or subscribe to it. - See more at: http://ourfollower.com/buy-youtube-subscribers/

    ReplyDelete
  8. Whether you need a handful of responsive subscribers added to your account, or a massive following, whether you want to promote a brand or yourself on buy youtube subscribers, we can help you out.

    ReplyDelete
  9. You are so awesome! I don't suppose I have read anything like this before.
    http://www.squidoo.com/appleaccessories555

    ReplyDelete
  10. Hi, I am a ebay listing software as well as web developer provider and I like to read and write article or blogs, mainly I read all blogs, it is my habit to collect information where ever I can, it will never waste ,today I caught your nice blog and it is written nicely with good content.....I appreciate it....

    ReplyDelete
  11. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks

    alot. sas online training .

    ReplyDelete
  12. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. PHP Online Training .

    ReplyDelete
  13. This comment has been removed by the author.

    ReplyDelete
  14. Thanks for this insightful post! Find more details and masterpapers reviews http://www.whowritesbest.com/masterpapers-com-review/

    ReplyDelete
  15. This comment has been removed by the author.

    ReplyDelete
  16. Thank you! For short and comprehensive tutorial! You can try out this servcie http://samedayessay.co.uk/dissertations.

    ReplyDelete
  17. Thanks a lot for this redmine guide! Hello! Get your essay per click on this website http://valwriting.net/

    ReplyDelete

  18. Hi, this is Jack from Chennai. Your blog is really very informative. Thanks for sharing this informative blog. SAS is a comprehensive statistical software system which integrates utilities for storing, modifying, analyzing, and graphing data. If anyone want to know more details please visit fita academy.

    Regards..
    SAS Course in Chennai




    ReplyDelete
  19. Hello there!
    Are you looking for some information to write an essay about ? Here order essay writing
    you can let this task for experst!

    ReplyDelete
  20. Great ideas! Thank you for this informative and useful post. Check out this site link to get more information.

    ReplyDelete
  21. Nice article. Sometimes Students face with issues in a essay writing and best essay writers at the service.

    ReplyDelete
  22. It’s really amazing that we can record what our visitors do on our site. Thanks for sharing this awesome guide. I’m happy that I came across with your site this article is on point,thanks again and have a great day. Keep update more information..

    CCNA Training in Chennai

    ReplyDelete
  23. this is really too useful and have more ideas from yours. keep sharing many techniques. eagerly waiting for your new blog and useful information. keep doing more.
    Digital Marketing Company in Chennai
    Digital Marketing Services in Chennai

    ReplyDelete
  24. I am good follower of your site. Daily i will refer your site for enhance my knowledge in the area of website designing. Toady you really taught me how to write good content for your site.Great jobs done by you.



    Informatica Training in chennai

    ReplyDelete
  25. Thank you for sharing such a nice and interesting blog with us. Hope it might be much useful for
    us. keep on updating...!!
    seo company in india
    digital marketing
    company in india

    ReplyDelete
  26. Excellent post, some great resources. Styling your blog the right way is key. This information is impressive..I am inspired with your post writing style & how continuously you describe this topic. After reading your post,thanks for taking the time to discuss this, I feel happy about and I am eager to learn more about this topic.

    Sofa Cleaning Mumbai

    ReplyDelete
  27. This was a very interesting read! Lots of opinion and very


    good research to be shared! Good feedback from the online


    readers as well. I must commend the author and web designer

    ReplyDelete
  28. I agree we share this blog explains it's changed mind way of doing the business.We Providers this output of others sites.
    Digital Marketing Training in Chennai
    Digital Marketing Course in Chennai

    ReplyDelete
  29. inspiring information! I am looking forward to reading more from you!
    PHP Training Institute in Chennai

    ReplyDelete
  30. Everybody experiences times of monetary pain. In many cases, we hurry to end this wretchedness and move beyond the circumstance at the earliest opportunity.Payday Loans San-diego

    ReplyDelete
  31. escort services :9769689450 Mumbai Escorts Well Educated girls Independent Service :Day/ Nigh. Meet our mumbai call girls Agency high class vip best profile model afford rate for 24X7 http://www.escortservicesmumbai.com/

    ReplyDelete
  32. SKARTEC Digital Marketing Academy is an institute dedicated to meet the integrated marketing needs of the industry. Our Digital Marketing Course in Chennai is ideal for those, who wish to manage a successful and sustainable digital marketing strategy.

    This digital marketing certification explores all the core digital marketing and management concepts, techniques and disciplines from planning, implementation and measurement to success and failure factors. Enrolling in this marketing course will prepare you to join an exclusive community of highly-recognized digital marketing experts.

    Digital Marketing Course in Chennai
    Digital Marketing Training in Chennai
    Online Digital Marketing Training
    SEO Training in Chennai
    Digital Marketing Course
    Digital Marketing Training
    Digital Marketing Courses

    ReplyDelete
  33. If you are on a no-break schedule for a long period of time, then that might bring in an adverse result. mumbai escorts
    mumbai escorts agency
    escorts in mumbai

    ReplyDelete

  34. Mumbai, the largest city in the Maharshtra, is located on the bank of the Jhelum River. The city boasts of worth-enjoying things waterfronts, gardens, houseboats etc. It is also famous for dried fruits and handicrafts. In addition to all these things, the city is also famous with regard to escort services.

    Mumbai Escorts

    erotic Call girls Mumbai

    Call Girls In Mumbai

    Mumbai Call Girls

    Mumbai escort Call girls

    Mumbai Escorts Service

    Indian Escorts in Mumbai

    Actress Escorts in Mumbais

    House Wife Escorts Mumbai

    Independent Escorts Service in Mumbai

    ReplyDelete
  35. Hi I am Neeta Chopra the best and high clas model escort in Delhi and offer an erotic independent escorts service in Delhi to

    gentlemen. Whatsapp me for urgent booking +91-8512888789

    Delhi Escorts

    Independent Escorts in Delhi

    Beautiful Escorts in Delhi

    Delhi Escorts Photos

    Cheap Escorts in Delhi

    Escort Services in Delhi

    Delhi Escorts Whatsapp Number

    Independent Female Escorts in Delhi

    ReplyDelete
  36. Awesome information, visit the Mutual Fund wala for Mutual Fund Distributor, Investment Advisor in Delhi and Mutual Fund Advisor.
    Investment Advisor in Delhi

    ReplyDelete
  37. https://www.mmfinfotech.com/Kautilyainfotech understand the math of promoting business online. We believe every business is a progeny of a great idea. Our job is to ensure the novelty of the idea reaches out to its target audience, through the means of digital marketing. Through our consummate team of bohemians, we have bolstered numerous businesses. Because ultimately, it’s the encouraging results that every client envisions after outsourcing their work to a robust digital marketing agency in indore mp.

    ReplyDelete


  38. Finally, you reach your desired destination with beautiful, sexy, sweet and escorts to fulfill your demand. Russian Escorts in Delhi is the place where you can make you each moment special and excitement with full of love, sex, flirt, fun and many more. Check our other Services...
    Call Girls in Aerocity
    Escorts in Aerocity
    Female Escorts in Aerocity
    Russian Escorts in Aerocity



    ReplyDelete
  39. OS Certification : Windows 7 (64 bit), Windows 10 (64 bit) (April 2018 Update or later), Linux 64 bit
    4608 NVIDIA CUDA cores running at 1770 MegaHertZ boost clock; NVIDIA Turing architecture
    New 72 RT cores for acceleration of ray tracing
    576 Tensor Cores for AI acceleration; Recommended power supply 650 watts
    24 GB of GDDR6 memory running at 14 Gigabits per second for up to 672 GB/s of memory bandwidth

    "
    NVIDIA Titan RTX Graphics Card
    "

    ReplyDelete
  40. You are providing a post is very useful for develop my knowledge and I learn more info from your blog.
    Digital Marketing Training In Kolkata
    Web Design Training In Kolkata
    SEO Training In Kolkata

    ReplyDelete
  41. Escort Service in Nagpur is such an authority in lovemaking services. These ladies will check out their adolescence in various forms of positions for many purposes. You can fuck Escort Service in Nagpur or invest a while in their arms. Almost everything depends upon your actions or your mood on the way you take care of them. These girls have blue eyes with lovely lashes. Very long and dense black hairs with the original busty determine that draws everyman toward them. Each of the magnificent Escort Service in Nagpur is all established to provide enormous love and care to their lover. On the subject of selecting your intimate lover, We all know that your choice is important while you fully grasp your requirements. We've been below to Allow you to fulfill your lust and sexual wants. Now, your sexual desires will likely be accomplished by our Model Escort Service in Nagpur.

    ReplyDelete
  42. Appreciate diverse sexual exercises with Nagpur Call Girls who will cause you to feel extraordinary and give you a suggestive end of the week that is loaded up with a wide scope of lewd delights and sensual exercises. You are certainly going to have a ton of fun with them as they are unconstrained, have an incredible comical inclination, mindful of 40 or more sexual exercises, and will be the hottest partner on your excursion. Go through an entire end of the week with them in lodging or make out in better places of Nagpur as they probably are aware of disconnected spots where you will locate nobody to upset you.

    ReplyDelete
  43. We are the best Escorts Service Provider in Ambala. Our call girls are the best in terms of sexual satisfaction with full pleasure, they are well qualified and professional working.
    Escorts in Ambala
    Ambala Escorts
    Escort Service in Ambala
    Call girl in Ambala

    ReplyDelete
  44. I simply want to mention I am just all new to blogging and site-building and truly loved you’re web page. Almost certainly I’m planning to bookmark your site . You really have outstanding stories. Many thanks for revealing your webpage.…

    Azure Training in Chennai

    Azure Training in Bangalore

    Azure Training in Hyderabad

    Azure Training in Pune

    Azure Training | microsoft azure certification | Azure Online Training Course

    Azure Online Training

    ReplyDelete
  45. Such a helpful article along with execution models, thanks for sharing.
    CRM Development Melbourne
    ERP Development Melbourne
    seo agency Melbourne

    ReplyDelete

  46. Wow, a great blog. I think my friend was wearing a vintage brown leather jacket. My friend suggested that I visit your blog to get useful information and now I’m also satisfied he was right. Now I’m your visitor. good work sir keep it up.



    Escorts in Kerala ||
    Escort Service in Kerala ||
    Kerala Escort ||
    Call Girl in Kerala ||
    Kerala Escort Service

    ReplyDelete
  47. The time has come to explore the sexy services for the bold requirement and bold requirements can do with the right services. Mahipalpur Escorts are now going to show you the ultimate cool performance of sex and this performance may never forget by you when you choose the ultimate services of sex.

    Mahipalpur Escorts
    Mahipalpur Escorts

    ReplyDelete
  48. Need the Best Call Girls? Call For Best Service in Udaipur


    The finest features and qualities of Female Call Girls in Udaipur. Let us take a look at the options and the availability of the Udaipur Call Girls. Our Udaikkpur Call girls are supple and can stay with you the whole night. All our call girls are sexy, blonde, and well-informed and offer top Call Girls Service in Udaipur.

    Udaipur call girls
    Udaipur nude females
    Udaipur escorts
    Sexy Udaipur call girls


    ReplyDelete

  49. South ex Call Girls Beauty with Killing Looks and Physique

    Our call girls Escorts in the south ex area are modish and stunning babes to enlighten your privacy with our professional Escorts that understand to maintain confidentiality about your privacy.South ex call girls now bring you the most lucrative deal for companionship as well as intimacy at inexpensive prices.
    South ex call girls
    South ex escorts
    Escorts in south ex
    Sexy escort in south ex

    ReplyDelete
  50. Entertain Yourself With Our Vasant Kunj Call Girl

    We are offered top high-class Vasant Kunj Escorts for the great journey of romance. Sometimes your body doesn't permit you to work regularly and need special attention to make your mood happy. Most of our Vasant Kunj Escorts Girls are well experienced for the professional people and always handle any situation professionally.

    Vasant kunj call girls
    Vasant kunj escorts
    Sexy call girl in vasant kunj
    Vasant kunj females

    ReplyDelete
  51. On the other hand, Young College Girls Escorts in Paharganj is also good for the pleasure of the customers and that’s why they can grab the best pleasure moments with these call girls. There is no need to worry about the bad things because Young College Escorts Call Girls are always ready to make sure your sexual satisfaction in the right way

    Paharganj escorts
    Paharganj escorts
    Paharganj escorts
    Paharganj escorts
    Paharganj escorts
    Paharganj escorts

    ReplyDelete
  52. Very good post and very informative as well. Your information appears very well on this subject and the way you have expanded it, any new person can understand it easily. I would like you to keep writing your posts and share your information with us.
    Mumbai Call Girls

    ReplyDelete
  53. My name is Pooja Roy, and I am an Independent Delhi Escort Service in Chhatarpur. If you want to meet me you have just booked my sensual sexual service to bring me towards your hot body. I like to spread jovial experiences for my clients. I am naturally sized 34C, having soft and tender skin for you to touch.
    I got the perfect figure for you to have fun with. So let’s get in touch and spend some quality time together.

    Chhatarpur Escorts services

    Chhatarpur Vip Escorts

    Chhatarpur Call Girls

    ReplyDelete
  54. He will make you a coward; because you ignore all your suffering and let her show you what she has and what she can accomplish for you! Sonal is constantly on interest, and that's something we're happy about. Whether you are around, Voyager, or here for a conference. Everyone has the right to feel spoiled, and really is what our girl is capable of. That is the score you need to see! Independent Chanakyapuri Escorts
    Chanakyapuri Escorts

    Escorts in Chanakyapuri

    Call Girls in Chanakyapuri

    Chanakyapuri Escorts Service

    ReplyDelete
  55. We are the main and most used organization of Chanakyapuri Call Girls organization that trust customers through and through and thus propose Chanakyapuri first rate female escorts that are picture-perfect like charitable girlfriends or partnerships to partner Chanakyapuri Escorts.
    Chanakyapuri Escorts

    Call Girls in Chanakyapuri

    ReplyDelete
  56. Love to read your blog! Thanks for posting some valuable post. Good one and appreciating blog. Keep updating.

    Java Training in Chennai

    Java Course in Chennai

    ReplyDelete
  57. hi, this is Chhatarpur Escort Service in Cheap Rate 8000 overnight we provider call girls In Chhatarpur, South Delhi near metro station our escorts girl fascinating features for Everything as your need whatever available into your previous sexual on bad relationship with them will be accessible to here huge amount of lovely moments captivating & stylish young escort girl and Housewife in your town and they keep search for companion for having sexual fun. Our service in your area able to do among a pleasure to seekers in the starting night day but could not break us Libertines started to show you enthusiasm into our provisions with the second years so we are happy to add some more kind our collection girls you, call us 24x7 we have in call also if you have your own hotel flat OYO room then we will drop at your doorsteps in cheap rate no need to pay extra to anyone
    Chhatarpur Escort

    Escorts in Chhatarpur

    Call Girls in Chhatarpur

    Chhatarpur Escorts Service

    ReplyDelete
  58. They are dedicated and adaptable and make fantastic sex partners or hook-up partners. There is a specific saying - Never judge the book by cover. Chanakyapuri Escort believe in call girls celebrations and show or make long cases. They are incredibly delightful and can let your faculties jump into the closeness or joy of a passionate night out. They are practical and progressive and can sense sexual need or abundance of energy without any stretch. Their committed happy administration can do a lot to quench the thirst for sexual desire and let you into the wonderland of Eradicate. It is the grandeur, style, devotion, competence, modesty and temperament of administration that they deliver, they are top notch. Subsequently, they are highly rated and a large number of our escorts receive endorsements in the form of bills of affection and gratitude for their service rendered.
    Chanakyapuri Escorts

    Escorts in Chanakyapuri

    Call Girls in Chanakyapuri

    Chanakyapuri Escorts Service

    ReplyDelete
  59. This is such a great resource that you are providing and you give it away for free. I love seeing blog that understand the value. Im glad to have found this post as its such an interesting one! I am always on the lookout for quality posts and articles so i suppose im lucky to have found this! I hope you will be adding more in the future... I will make 40 unique profile backlinks on top domains

    ReplyDelete
  60. Are you looking for a Dubai Infographic Submission List 2021?. Below is list of Dubai Organization Listing Sites which you can make use of to obtain top quality backlink for your site as well as listing your company today to place higher in regional search as well as grow your online.

    ReplyDelete
  61. Decide what you want to do with them. Our Nepali Call Girls in Pune surely can give you almost everything.Punjabi Call Girls in Pune Set an appointment and taste the sex,Cheap Call Girls in Agra you've never met before! These are real goddesses whose smell of the pussies will remain in your memories for a long time.High Profile Escorts in Dehradun If you want fun, spend a night with one of these models.High Profile Escorts in Dehradun Remember you are the one who chooses a scenario of this night.Nepali Call Girls in Gurgaon Pick your Russian girl and call her right now.

    ReplyDelete
  62. I just want to let you know that I just check out your site and I find it very interesting and informative.. https://zetamatic.com/downloads/checkout-address-autofill-for-woocommerce-pro/

    ReplyDelete
  63. ZModeler 3.4.1 Build 1194 Crack is a powerful application, it can make 3D models for video games, you can also effortlessly make models for other uses. Zmodeler 3 Full Crack

    ReplyDelete
  64. In this article, We are going to share with you some unused and working free License Key & Activation Code for Kaspersky Internet Security. Kaspersky Internet Security Activation Code Free

    ReplyDelete
  65. if you want to know how your journey is so far, then think about the first day of school and think your today; you may smile in your heart, but you have a long First Day College Quotes

    ReplyDelete
  66. Yerli ve yabancı altılı ganyan tahminleriyle, yarışseverlerin başarılı oyun kurgulamasına yardımcı olan platformumuzdan ücretsiz bir şekilde faydalanabilirsiniz.

    ReplyDelete
  67. My website name is kaise online blog. Here I write job description related to government jobs. Most people give importance to secure career option after completing their studies so I believe that satisfied life which can be only achieved by an govt job.

    ReplyDelete
  68. Great Information Provided Thanks For The Information .Keep Posting more !
    scrum-master-training-in-hyderabad

    ReplyDelete