Monday, December 27, 2010

Securing the Redmine_S3 plugin

We run redmine internally here at Fuery Solutions. Redmine is a fantastic tool for managing software development projects.

One of the unfortunate "features" redmine has is the habit of storing uploaded files without any security, regardless of whether the system itself is password protected or not. The redmine s3 plugin echoes this habit, setting all uploaded documents to readable by the entire internet. Obviously, the URLs are somewhat obscure, but as the cliche goes, obscurity is not security.

Here are instructions for altering the plugin to use temporary authorized URLs. This effectively offloads the security requirements to Amazon's formidable infrastructure.

These instructions apply to:

  • Redmine 1.0.x
  • Redmine_S3 v 0.03
Files you'll be editing (where "redmine" is your rails application root):
  1. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/attachment_patch.rb
  2. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/attachments_controller_patch.rb
  3. redmine/vendor/plugins/redmine_s3/lib/redmine_s3/connection.rb
First, we need to disable the "set newly uploaded files to be readable" command. This entails commenting a single line in attachment_patch.rb, on line 24:

#Private (not readable by everyone) is the default.
#RedmineS3::Connection.publicly_readable!(path_to_file)

This handles newly created files. Next, we need to add the capability to retrieve a URI with the AWS temporary authorization keys. The S3 lib the plugin uses actually contains theses goodies already, so we just need a wrapper function in connection.rb that uses the QueryStringAuthGenerator class. This function isn't as clean as it could be, but we threw this together in an hour. Add this function to the Connection class in connection.rb:


def self.private_uri(filepath)
 load_options unless @@access_key_id && @@secret_acces_key
 @@qs_conn = S3::QueryStringAuthGenerator.new(@@access_key_id, @@secret_acces_key, false) unless @@qs_conn
 @@qs_conn.get(bucket, filepath)
end


I added this on line 37, between the bucket and uri functions. You'll also, of course, need to initialize @@qs_conn by adding this at the beginning of the file (line 7 or so):


@@qs_conn = nil

Finally, we need to adjust the controller function that handles the response to the attachment GET requests themselves. Adjust attachments_controller_path.rb on line 23:

#Comment the current line 23.
#redirect_to("#{RedmineS3::Connection.uri/#{@attachment.path_to_file}") 
#New code
redirect_to("#{RedmineS3::Connection.private_uri(@attachment.path_to_file)}") 


Don't forget to restart your application after performing these changes. You'll also, of course, need to adjust the file settings in AWS for previously uploaded files. Although this new code works for viewing those files, the security settings ("visible to everyone") need to be reset manually.


120 comments:

  1. Thanks for the post!! that really helped me out.

    ReplyDelete
    Replies
    1. Cyber Security Projects

      projects for cse

      Networking Projects

      JavaScript Training in Chennai

      JavaScript Training in Chennai

      The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

      Delete
  2. inspiring information! I am looking forward to reading more from you!

    ReplyDelete
  3. Really its very good post.knowledge sharing is the optimum result of knowledge gaining.

    ReplyDelete
  4. Open application programming interfaces (APIs) provide a standard interface, allowing third parties to create plug-ins that interact with the host application. A stable API allows third-party plug-ins to continue to function as the original version changes and to extend the life-cycle of obsolete applications.

    Thanks
    Michael
    windows95 computer

    ReplyDelete
  5. I must say, This is just awesome. Keep it up

    ReplyDelete
  6. I feel really nice reading these articles I mean there are writers that can write good material. I appreciated your professional way of writing this post.
    http://williambleimeister.com/

    ReplyDelete
  7. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. informatica online training .

    ReplyDelete
  8. We will provide you thousands of subscribers at an affordable price. This is a whole new concept that will help you to quickly, easily and effectively build real YouTube subscribers. (Buy YouTube Subscribers) Videos with a good number of subscribers automatically attract other people to have a look at the video and like, comment or subscribe to it. - See more at: http://ourfollower.com/buy-youtube-subscribers/

    ReplyDelete
  9. Whether you need a handful of responsive subscribers added to your account, or a massive following, whether you want to promote a brand or yourself on buy youtube subscribers, we can help you out.

    ReplyDelete
  10. You are so awesome! I don't suppose I have read anything like this before.
    http://www.squidoo.com/appleaccessories555

    ReplyDelete
  11. I’m glad to read you again. Thanks for this post.
    Best for you Buddy! Merry Christmas
    Dont Forget see my website www.7liveasia.com

    ReplyDelete
  12. Hi, I am a ebay listing software as well as web developer provider and I like to read and write article or blogs, mainly I read all blogs, it is my habit to collect information where ever I can, it will never waste ,today I caught your nice blog and it is written nicely with good content.....I appreciate it....

    ReplyDelete
  13. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. PHP Online Training .

    ReplyDelete
  14. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. SAP ABAP ONLINE TRAINING.

    ReplyDelete
  15. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks

    alot. sas online training .

    ReplyDelete
  16. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. PHP Online Training .

    ReplyDelete
  17. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. QA Online Training .

    ReplyDelete
  18. Thank you provide valuable informations and iam seacrching same informations,and saved my time SAS Online Training

    ReplyDelete
  19. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. QTP Online Training .

    ReplyDelete
  20. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. Selenium ONLINE TRAINING.

    ReplyDelete
  21. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. Manual Testing ONLINE TRAINING.

    ReplyDelete
  22. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. QTP ONLINE TRAINING.

    ReplyDelete
  23. Nice information. I was searching for the same. It helped me alot and saved my time. Thanks alot. UFT Online Training .

    ReplyDelete
  24. This comment has been removed by the author.

    ReplyDelete
  25. Thanks for this insightful post! Find more details and masterpapers reviews http://www.whowritesbest.com/masterpapers-com-review/

    ReplyDelete
  26. This comment has been removed by the author.

    ReplyDelete
  27. Thank you! For short and comprehensive tutorial! You can try out this servcie http://samedayessay.co.uk/dissertations.

    ReplyDelete
  28. Thanks a lot for this redmine guide! Hello! Get your essay per click on this website http://valwriting.net/

    ReplyDelete

  29. Hi, this is Jack from Chennai. Your blog is really very informative. Thanks for sharing this informative blog. SAS is a comprehensive statistical software system which integrates utilities for storing, modifying, analyzing, and graphing data. If anyone want to know more details please visit fita academy.

    Regards..
    SAS Course in Chennai




    ReplyDelete
  30. Hello there!
    Are you looking for some information to write an essay about ? Here order essay writing
    you can let this task for experst!

    ReplyDelete
  31. Great ideas! Thank you for this informative and useful post. Check out this site link to get more information.

    ReplyDelete
  32. Nice article. Sometimes Students face with issues in a essay writing and best essay writers at the service.

    ReplyDelete
  33. It’s really amazing that we can record what our visitors do on our site. Thanks for sharing this awesome guide. I’m happy that I came across with your site this article is on point,thanks again and have a great day. Keep update more information..

    CCNA Training in Chennai

    ReplyDelete
  34. Wow amazing i saw the article with execution models you had posted. It was such informative.By explaining this type we can identify the concepts easily. So thank you for this sharing.

    Web Designing Training in Chennai Adyar

    ReplyDelete
  35. Great articles, first of all Thanks for writing such lovely Post! Earlier I thought that posts are the only most important thing on any blog. But here at Shoutmeloud I found how important other elements are for your blog.Keep update more posts..

    Online Training in Chennai

    ReplyDelete
  36. this is really too useful and have more ideas from yours. keep sharing many techniques. eagerly waiting for your new blog and useful information. keep doing more.
    Digital Marketing Company in Chennai
    Digital Marketing Services in Chennai

    ReplyDelete
  37. Provides great information about the concept.It helps an individual to gain knowledge on new techniques.Keep on giving this type of information.
    SEO Training in Chennai

    ReplyDelete
  38. I am good follower of your site. Daily i will refer your site for enhance my knowledge in the area of website designing. Toady you really taught me how to write good content for your site.Great jobs done by you.



    Informatica Training in chennai

    ReplyDelete
  39. Superb. I really enjoyed very much with this article here. Really it is an amazing article I had ever read. I hope it will help a lot for all. Thank you so much for this amazing posts and please keep update like this excellent article.thank you for sharing such a great blog with us. expecting for your.
    Digital Marketing Company in India

    ReplyDelete
  40. Thank you for sharing such a nice and interesting blog with us. Hope it might be much useful for
    us. keep on updating...!!
    seo company in india
    digital marketing
    company in india

    ReplyDelete
  41. Excellent post, some great resources. Styling your blog the right way is key. This information is impressive..I am inspired with your post writing style & how continuously you describe this topic. After reading your post,thanks for taking the time to discuss this, I feel happy about and I am eager to learn more about this topic.

    Sofa Cleaning Mumbai

    ReplyDelete
  42. This was a very interesting read! Lots of opinion and very


    good research to be shared! Good feedback from the online


    readers as well. I must commend the author and web designer

    ReplyDelete
  43. I agree we share this blog explains it's changed mind way of doing the business.We Providers this output of others sites.
    Digital Marketing Training in Chennai
    Digital Marketing Course in Chennai

    ReplyDelete
  44. Great and nice blog thanks sharing..I just want to say that all the information you have given here is awesome...
    Software Training institute in Velachery
    PHP Training in Velachery

    ReplyDelete
  45. Interesting blog which attracted me more.I hope you will post more update like this.
    Digital marketing company in Chennai

    ReplyDelete
  46. Thank you so much for posting like this. I enjoyed much more here. So please keep update like this.

    Medical Insurance Plans

    Health Insurance UAE

    Insurance Companies in Dubai

    ReplyDelete
  47. inspiring information! I am looking forward to reading more from you!
    PHP Training Institute in Chennai

    ReplyDelete
  48. Everybody experiences times of monetary pain. In many cases, we hurry to end this wretchedness and move beyond the circumstance at the earliest opportunity.Payday Loans San-diego

    ReplyDelete
  49. escort services :9769689450 Mumbai Escorts Well Educated girls Independent Service :Day/ Nigh. Meet our mumbai call girls Agency high class vip best profile model afford rate for 24X7 http://www.escortservicesmumbai.com/

    ReplyDelete
  50. Welcome to Mumbai Independent Models Escorts agency offering the maximum beautiful Independent Models escorts in Mumbai
    and Andheri in addition to other choose cities in India.We are confident that you'll no longer discover an agency that
    gives such lovely escorts in Andheri and Mumbai as we do, whatever the occasion. We have a various selection of
    appealing, pleasant women waiting to escort you right here in Mumbai. Whether for delight journeys, business activities,
    corporate activities, functions or dinner dates, our escorts in Mumbai and Bandra can fulfill your requirements. They
    have been mainly hand picked to offer the best stage of carrier feasible with professionalism,
    Visit My website online :- http://www.Escortservicesmumbai.Com/
    Visit My web page :- http://www.Escortgirlinmumbai.Com/
    Visit My web page :- http://www.Escorts69.Biz/

    ReplyDelete
  51. SKARTEC Digital Marketing Academy is an institute dedicated to meet the integrated marketing needs of the industry. Our Digital Marketing Course in Chennai is ideal for those, who wish to manage a successful and sustainable digital marketing strategy.

    This digital marketing certification explores all the core digital marketing and management concepts, techniques and disciplines from planning, implementation and measurement to success and failure factors. Enrolling in this marketing course will prepare you to join an exclusive community of highly-recognized digital marketing experts.

    Digital Marketing Course in Chennai
    Digital Marketing Training in Chennai
    Online Digital Marketing Training
    SEO Training in Chennai
    Digital Marketing Course
    Digital Marketing Training
    Digital Marketing Courses

    ReplyDelete
  52. If you are on a no-break schedule for a long period of time, then that might bring in an adverse result. mumbai escorts
    mumbai escorts agency
    escorts in mumbai

    ReplyDelete
  53. we repair and service all models of oneplus Service in Chennai, We rely on customer satisfaction. We can service all problems faced by oneplus customers in chennai.


    Oneplus Service Center in Chennai | Oneplus Service Centre | Oneplus Service Center | Oneplus Service Center near me | Oneplus Service Center in velachery | Oneplus Service Chennai

    ReplyDelete

  54. Mumbai, the largest city in the Maharshtra, is located on the bank of the Jhelum River. The city boasts of worth-enjoying things waterfronts, gardens, houseboats etc. It is also famous for dried fruits and handicrafts. In addition to all these things, the city is also famous with regard to escort services.

    Mumbai Escorts

    erotic Call girls Mumbai

    Call Girls In Mumbai

    Mumbai Call Girls

    Mumbai escort Call girls

    Mumbai Escorts Service

    Indian Escorts in Mumbai

    Actress Escorts in Mumbais

    House Wife Escorts Mumbai

    Independent Escorts Service in Mumbai

    ReplyDelete
  55. Hi I am Neeta Chopra the best and high clas model escort in Delhi and offer an erotic independent escorts service in Delhi to

    gentlemen. Whatsapp me for urgent booking +91-8512888789

    Delhi Escorts

    Independent Escorts in Delhi

    Beautiful Escorts in Delhi

    Delhi Escorts Photos

    Cheap Escorts in Delhi

    Escort Services in Delhi

    Delhi Escorts Whatsapp Number

    Independent Female Escorts in Delhi

    ReplyDelete
  56. Get the quality oriented and the best independent College Girl Delhi escorts services from Mahek just for you to offer extreme pleasure.
    Delhi Escorts

    ReplyDelete
  57. Nice blog, Get the responsive and creative website designing and Digital Marketing services by ogen infosystem.
    SEO Service in Delhi

    ReplyDelete
  58. Awesome information, visit the Mutual Fund wala for Mutual Fund Distributor, Investment Advisor in Delhi and Mutual Fund Advisor.
    Investment Advisor in Delhi

    ReplyDelete
  59. Oxigen BC Private Limited Company is India's Largest CSP Provider, which works in all the states of India to open customer service point of all banks. Such as - sbi, boi, bob, pnb etc.

    CSP Apply
    CSP Online Application
    Online CSP Apply
    CSP Registration
    CSP Online Application
    CSP Provider

    ReplyDelete
  60. A large number of people, particularly the migrant laborers and factory workers do not have a saving account and even not able to open an account due to lack of valid address and ID proof. As a result they face difficulties to save their earnings in a safe place and look out for solution to send money to their families.

    CSP Apply
    CSP Online Application
    Apply for CSP
    Top CSP Provider in India
    Apply Online For Bank CSP
    Online Money Transfer

    ReplyDelete
  61. Welcome to our hight quality Mumbai Escort Agency. When you are looking best female escorts in Mumbai then this is right services for you. it may be hard to find and good escort services in entire city which provides cute and energetic escorts in Mumbai that look just good as appeared in pictures or better than their pictures. Sometimes portfolio hides the much deterioration about them. So pictures and physical appearence, both are different things. mumbai is a well-known city around the world.

    Model escorts in mumbai

    Callgirls in mumbai

    Housewifes in mumbai

    Mumbai escorts

    College girls in mumbai

    ReplyDelete
  62. Welcome to our hight quality Mumbai Escort Agency. When you are looking best female escorts in Mumbai then this is right services for you. it may be hard to find and good escort services in entire city which provides cute and energetic escorts in Mumbai that look just good as appeared in pictures or better than their pictures. Sometimes portfolio hides the much deterioration about them. So pictures and physical appearence, both are different things. mumbai is a well-known city around the world.

    Model escorts in mumbai

    Callgirls in mumbai

    Housewifes in mumbai

    Mumbai escorts

    College girls in mumbai

    ReplyDelete
  63. Ombre Powder Glow brows is a technique performed with the assistance of a Master Liner Machine and provides a soft appearance that is both natural looking and long lasting. This brow type typically lasts 1-2 years.

    Microblading
    Permanent Makeup
    Microblading Los Angeles
    Eyebrows
    Eyebrow Tattoo
    Cosmetic Tattoo
    Ombre Eyebrows
    Powder Eyebrows

    ReplyDelete
  64. We have worked with many businesses in New Zealand and abroad and we have found that although there has been massive growth in technology, most small to medium sized business owners have been left behind.

    Website Development Services in New Zealand
    Software Development Services in New Zealand
    E-Commerce Development Services in New Zealand
    Content Writing Services in New Zealand
    Digital Marketing Services in New Zealand

    ReplyDelete
  65. Oxigen BC Private Limited Company is India's Largest CSP Provider, which works in all the states of India to open customer service point of all banks. Such as - sbi, boi, bob, pnb etc.

    CSP Apply
    CSP Online Application
    Online CSP Apply
    CSP Registration
    CSP Online Application
    CSP Provider

    ReplyDelete
  66. A large number of people, particularly the migrant laborers and factory workers do not have a saving account and even not able to open an account due to lack of valid address and ID proof. As a result they face difficulties to save their earnings in a safe place and look out for solution to send money to their families.

    Apply CSP
    CSP Registration
    CSP Provider
    Bank CSP
    CSP Kisok

    ReplyDelete
  67. https://www.mmfinfotech.com/Kautilyainfotech understand the math of promoting business online. We believe every business is a progeny of a great idea. Our job is to ensure the novelty of the idea reaches out to its target audience, through the means of digital marketing. Through our consummate team of bohemians, we have bolstered numerous businesses. Because ultimately, it’s the encouraging results that every client envisions after outsourcing their work to a robust digital marketing agency in indore mp.

    ReplyDelete


  68. Finally, you reach your desired destination with beautiful, sexy, sweet and escorts to fulfill your demand. Russian Escorts in Delhi is the place where you can make you each moment special and excitement with full of love, sex, flirt, fun and many more. Check our other Services...
    Call Girls in Aerocity
    Escorts in Aerocity
    Female Escorts in Aerocity
    Russian Escorts in Aerocity



    ReplyDelete
  69. OS Certification : Windows 7 (64 bit), Windows 10 (64 bit) (April 2018 Update or later), Linux 64 bit
    4608 NVIDIA CUDA cores running at 1770 MegaHertZ boost clock; NVIDIA Turing architecture
    New 72 RT cores for acceleration of ray tracing
    576 Tensor Cores for AI acceleration; Recommended power supply 650 watts
    24 GB of GDDR6 memory running at 14 Gigabits per second for up to 672 GB/s of memory bandwidth

    "
    NVIDIA Titan RTX Graphics Card
    "

    ReplyDelete

  70. Astonishing article that I have never seen before. I aimed to write an article based on this tally field, but my startings were rejected...Now, the information that you have designed in this blog was misery to read about this tally and its technical features. Surely these writings will help the beginners and the professionals. Thanks

    Tally ERP 9 Training
    tally classes
    Tally Training institute in Chennai
    Tally course in Chennai
    seo training classes
    seo training course
    seo training institute in chennai
    seo training institutes
    seo courses in chennai
    seo institutes in chennai
    seo classes in chennai
    seo training center in chennai

    ReplyDelete
  71. You are providing a post is very useful for develop my knowledge and I learn more info from your blog.
    Digital Marketing Training In Kolkata
    Web Design Training In Kolkata
    SEO Training In Kolkata

    ReplyDelete
  72. Escort Service in Nagpur is such an authority in lovemaking services. These ladies will check out their adolescence in various forms of positions for many purposes. You can fuck Escort Service in Nagpur or invest a while in their arms. Almost everything depends upon your actions or your mood on the way you take care of them. These girls have blue eyes with lovely lashes. Very long and dense black hairs with the original busty determine that draws everyman toward them. Each of the magnificent Escort Service in Nagpur is all established to provide enormous love and care to their lover. On the subject of selecting your intimate lover, We all know that your choice is important while you fully grasp your requirements. We've been below to Allow you to fulfill your lust and sexual wants. Now, your sexual desires will likely be accomplished by our Model Escort Service in Nagpur.

    ReplyDelete
  73. Behror escort service world class model profile is provided for independent call girls agency: here is your option to choose any permissions low rate for service on our website, which we can provide you in any area of Rajasthan Can be provided.Behror Escort

    ReplyDelete
  74. For information about call girls in Connaught Place, you can get information by reading our blog, you can get call girls service in Connaught Place anytime.call girls in connaught place

    ReplyDelete
  75. Appreciate diverse sexual exercises with Nagpur Call Girls who will cause you to feel extraordinary and give you a suggestive end of the week that is loaded up with a wide scope of lewd delights and sensual exercises. You are certainly going to have a ton of fun with them as they are unconstrained, have an incredible comical inclination, mindful of 40 or more sexual exercises, and will be the hottest partner on your excursion. Go through an entire end of the week with them in lodging or make out in better places of Nagpur as they probably are aware of disconnected spots where you will locate nobody to upset you.

    ReplyDelete
  76. We are the best Escorts Service Provider in Ambala. Our call girls are the best in terms of sexual satisfaction with full pleasure, they are well qualified and professional working.
    Escorts in Ambala
    Ambala Escorts
    Escort Service in Ambala
    Call girl in Ambala

    ReplyDelete




  77. Each of the women associated with our agency is strictly professional when it comes to rendering her services to her clients.Call Girls in Gurgaonhere at our escort agency make sure that their talents are such that they will never fall short of giving the best of services to their clients. Check our other Services...
    Escorts in Gurgaon
    Hi Profile Escorts in Gurgaon
    Russian Call Girls in Gurgaon
    Call Girls in Gurgaon
    Escorts in Gurgaon

    ReplyDelete
  78. Biology assignment writing services have come up with Biological Science Writing Services for biology coursework writing service students in order for them to score straight A’s in their biology research paper writing services.

    ReplyDelete

  79. I found your post while searching for some related information on blog search...It is a good post..keep posting and update the information.
    Escorts in Dehradun |
    Escort Service in Dehradun |
    Dehradun Escort |
    Call Girl in Dehradun |
    Escort Girls in Dehradun

    ReplyDelete