Monday, December 27, 2010

Securing the Redmine_S3 plugin

We run redmine internally here at Fuery Solutions. Redmine is a fantastic tool for managing software development projects.

One of the unfortunate "features" redmine has is the habit of storing uploaded files without any security, regardless of whether the system itself is password protected or not. The redmine s3 plugin echoes this habit, setting all uploaded documents to readable by the entire internet. Obviously, the URLs are somewhat obscure, but as the cliche goes, obscurity is not security.

Here are instructions for altering the plugin to use temporary authorized URLs. This effectively offloads the security requirements to Amazon's formidable infrastructure.

These instructions apply to:

  • Redmine 1.0.x
  • Redmine_S3 v 0.03
Files you'll be editing (where "redmine" is your rails application root):
  1. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/attachment_patch.rb
  2. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/attachments_controller_patch.rb
  3. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/connection.rb
First, we need to disable the "set newly uploaded files to be readable" command. This entails commenting a single line in attachment_patch.rb, on line 24:

#Private (not readable by everyone) is the default.

This handles newly created files. Next, we need to add the capability to retrieve a URI with the AWS temporary authorization keys. The S3 lib the plugin uses actually contains theses goodies already, so we just need a wrapper function in connection.rb that uses the QueryStringAuthGenerator class. This function isn't as clean as it could be, but we threw this together in an hour. Add this function to the Connection class in connection.rb:

def self.private_uri(filepath)
 load_options unless @@access_key_id && @@secret_acces_key
 @@qs_conn =, @@secret_acces_key, false) unless @@qs_conn
 @@qs_conn.get(bucket, filepath)

I added this on line 37, between the bucket and uri functions. You'll also, of course, need to initialize @@qs_conn by adding this at the beginning of the file (line 7 or so):

@@qs_conn = nil

Finally, we need to adjust the controller function that handles the response to the attachment GET requests themselves. Adjust attachments_controller_path.rb on line 23:

#Comment the current line 23.
#New code

Don't forget to restart your application after performing these changes. You'll also, of course, need to adjust the file settings in AWS for previously uploaded files. Although this new code works for viewing those files, the security settings ("visible to everyone") need to be reset manually.


  1. Thanks for the post!! that really helped me out.

  2. inspiring information! I am looking forward to reading more from you!

  3. Really its very good post.knowledge sharing is the optimum result of knowledge gaining.

  4. Open application programming interfaces (APIs) provide a standard interface, allowing third parties to create plug-ins that interact with the host application. A stable API allows third-party plug-ins to continue to function as the original version changes and to extend the life-cycle of obsolete applications.

    windows95 computer

  5. I must say, This is just awesome. Keep it up

  6. I feel really nice reading these articles I mean there are writers that can write good material. I appreciated your professional way of writing this post.

  7. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. informatica online training .

  8. We will provide you thousands of subscribers at an affordable price. This is a whole new concept that will help you to quickly, easily and effectively build real YouTube subscribers. (Buy YouTube Subscribers) Videos with a good number of subscribers automatically attract other people to have a look at the video and like, comment or subscribe to it. - See more at:

  9. Whether you need a handful of responsive subscribers added to your account, or a massive following, whether you want to promote a brand or yourself on buy youtube subscribers, we can help you out.

  10. You are so awesome! I don't suppose I have read anything like this before.

  11. I’m glad to read you again. Thanks for this post.
    Best for you Buddy! Merry Christmas
    Dont Forget see my website

  12. Hi, I am a ebay listing software as well as web developer provider and I like to read and write article or blogs, mainly I read all blogs, it is my habit to collect information where ever I can, it will never waste ,today I caught your nice blog and it is written nicely with good content.....I appreciate it....

  13. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. PHP Online Training .

  14. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. SAP ABAP ONLINE TRAINING.

  15. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks

    alot. sas online training .

  16. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. PHP Online Training .

  17. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. QA Online Training .

  18. Thank you provide valuable informations and iam seacrching same informations,and saved my time SAS Online Training

  19. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. QTP Online Training .

  20. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. Selenium ONLINE TRAINING.

  21. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. Manual Testing ONLINE TRAINING.

  22. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. QTP ONLINE TRAINING.

  23. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. UFT Online Training .

  24. This comment has been removed by the author.

  25. Thanks for this insightful post! Find more details and masterpapers reviews

  26. This comment has been removed by the author.

  27. Thank you! For short and comprehensive tutorial! You can try out this servcie

  28. Thanks a lot for this redmine guide! Hello! Get your essay per click on this website


  29. Hi, this is Jack from Chennai. Your blog is really very informative. Thanks for sharing this informative blog. SAS is a comprehensive statistical software system which integrates utilities for storing, modifying, analyzing, and graphing data. If anyone want to know more details please visit fita academy.

    SAS Course in Chennai

  30. Hello there!
    Are you looking for some information to write an essay about ? Here order essay writing
    you can let this task for experst!

  31. Great ideas! Thank you for this informative and useful post. Check out this site link to get more information.

  32. Nice article. Sometimes Students face with issues in a essay writing and best essay writers at the service.

  33. It’s really amazing that we can record what our visitors do on our site. Thanks for sharing this awesome guide. I’m happy that I came across with your site this article is on point,thanks again and have a great day. Keep update more information..

    CCNA Training in Chennai

  34. Wow amazing i saw the article with execution models you had posted. It was such informative.By explaining this type we can identify the concepts easily. So thank you for this sharing.

    Web Designing Training in Chennai Adyar

  35. Great articles, first of all Thanks for writing such lovely Post! Earlier I thought that posts are the only most important thing on any blog. But here at Shoutmeloud I found how important other elements are for your blog.Keep update more posts..

    Online Training in Chennai

  36. this is really too useful and have more ideas from yours. keep sharing many techniques. eagerly waiting for your new blog and useful information. keep doing more.
    Digital Marketing Company in Chennai
    Digital Marketing Services in Chennai

  37. Provides great information about the concept.It helps an individual to gain knowledge on new techniques.Keep on giving this type of information.
    SEO Training in Chennai

  38. I am good follower of your site. Daily i will refer your site for enhance my knowledge in the area of website designing. Toady you really taught me how to write good content for your site.Great jobs done by you.

    Informatica Training in chennai

  39. Superb. I really enjoyed very much with this article here. Really it is an amazing article I had ever read. I hope it will help a lot for all. Thank you so much for this amazing posts and please keep update like this excellent article.thank you for sharing such a great blog with us. expecting for your.
    Digital Marketing Company in India

  40. Thank you for sharing such a nice and interesting blog with us. Hope it might be much useful for
    us. keep on updating...!!
    seo company in india
    digital marketing
    company in india

  41. Excellent post, some great resources. Styling your blog the right way is key. This information is impressive..I am inspired with your post writing style & how continuously you describe this topic. After reading your post,thanks for taking the time to discuss this, I feel happy about and I am eager to learn more about this topic.

    Sofa Cleaning Mumbai

  42. This was a very interesting read! Lots of opinion and very

    good research to be shared! Good feedback from the online

    readers as well. I must commend the author and web designer

  43. I agree we share this blog explains it's changed mind way of doing the business.We Providers this output of others sites.
    Digital Marketing Training in Chennai
    Digital Marketing Course in Chennai

  44. Great and nice blog thanks sharing..I just want to say that all the information you have given here is awesome...
    Software Training institute in Velachery
    PHP Training in Velachery

  45. Interesting blog which attracted me more.I hope you will post more update like this.
    Digital marketing company in Chennai

  46. Thank you so much for posting like this. I enjoyed much more here. So please keep update like this.

    Medical Insurance Plans

    Health Insurance UAE

    Insurance Companies in Dubai

  47. inspiring information! I am looking forward to reading more from you!
    PHP Training Institute in Chennai

  48. Everybody experiences times of monetary pain. In many cases, we hurry to end this wretchedness and move beyond the circumstance at the earliest opportunity.Payday Loans San-diego

  49. escort services :9769689450 Mumbai Escorts Well Educated girls Independent Service :Day/ Nigh. Meet our mumbai call girls Agency high class vip best profile model afford rate for 24X7

  50. Welcome to Mumbai Independent Models Escorts agency offering the maximum beautiful Independent Models escorts in Mumbai
    and Andheri in addition to other choose cities in India.We are confident that you'll no longer discover an agency that
    gives such lovely escorts in Andheri and Mumbai as we do, whatever the occasion. We have a various selection of
    appealing, pleasant women waiting to escort you right here in Mumbai. Whether for delight journeys, business activities,
    corporate activities, functions or dinner dates, our escorts in Mumbai and Bandra can fulfill your requirements. They
    have been mainly hand picked to offer the best stage of carrier feasible with professionalism,
    Visit My website online :- http://www.Escortservicesmumbai.Com/
    Visit My web page :- http://www.Escortgirlinmumbai.Com/
    Visit My web page :- http://www.Escorts69.Biz/

  51. SKARTEC Digital Marketing Academy is an institute dedicated to meet the integrated marketing needs of the industry. Our Digital Marketing Course in Chennai is ideal for those, who wish to manage a successful and sustainable digital marketing strategy.

    This digital marketing certification explores all the core digital marketing and management concepts, techniques and disciplines from planning, implementation and measurement to success and failure factors. Enrolling in this marketing course will prepare you to join an exclusive community of highly-recognized digital marketing experts.

    Digital Marketing Course in Chennai
    Digital Marketing Training in Chennai
    Online Digital Marketing Training
    SEO Training in Chennai
    Digital Marketing Course
    Digital Marketing Training
    Digital Marketing Courses

  52. If you are on a no-break schedule for a long period of time, then that might bring in an adverse result. mumbai escorts
    mumbai escorts agency
    escorts in mumbai

  53. we repair and service all models of oneplus Service in Chennai, We rely on customer satisfaction. We can service all problems faced by oneplus customers in chennai.

    Oneplus Service Center in Chennai | Oneplus Service Centre | Oneplus Service Center | Oneplus Service Center near me | Oneplus Service Center in velachery | Oneplus Service Chennai


  54. Mumbai, the largest city in the Maharshtra, is located on the bank of the Jhelum River. The city boasts of worth-enjoying things waterfronts, gardens, houseboats etc. It is also famous for dried fruits and handicrafts. In addition to all these things, the city is also famous with regard to escort services.

    Mumbai Escorts

    erotic Call girls Mumbai

    Call Girls In Mumbai

    Mumbai Call Girls

    Mumbai escort Call girls

    Mumbai Escorts Service

    Indian Escorts in Mumbai

    Actress Escorts in Mumbais

    House Wife Escorts Mumbai

    Independent Escorts Service in Mumbai

  55. Hi I am Neeta Chopra the best and high clas model escort in Delhi and offer an erotic independent escorts service in Delhi to

    gentlemen. Whatsapp me for urgent booking +91-8512888789

    Delhi Escorts

    Independent Escorts in Delhi

    Beautiful Escorts in Delhi

    Delhi Escorts Photos

    Cheap Escorts in Delhi

    Escort Services in Delhi

    Delhi Escorts Whatsapp Number

    Independent Female Escorts in Delhi

  56. Get the quality oriented and the best independent College Girl Delhi escorts services from Mahek just for you to offer extreme pleasure.
    Delhi Escorts

  57. Nice blog, Get the responsive and creative website designing and Digital Marketing services by ogen infosystem.
    SEO Service in Delhi

  58. Awesome information, visit the Mutual Fund wala for Mutual Fund Distributor, Investment Advisor in Delhi and Mutual Fund Advisor.
    Investment Advisor in Delhi