In a CakePHP3 application that requires Authentication/Authorization, I have the possibility of images being uploaded. Now I would like to avoid Users being able to see other users images by e.g. guessing image names or such. Also I would like to use the ids of the entities as filenames which would make it also easy to guess.
So how would you implement authorization for assets?
I would prevent the "guessing" of filenames just by generating a random long enough unguessable string of chars as the new filename, like Facebook does with uploading photos:
Because we shouldn't bother at all with the original name of files, we could rename the file that a user uploads. For example User 24976 uploads a file that is called tomato12.png. The upload script will then rename the file to (for example) the following name:
1481540475_24976_iDewM51NYrBYgnIh.png
It consists out of four parts:
[timestamp]_[userId]_[randomString].[suffix]
And then, save the filename into the database. If you would look into the uploads directory, you could be able to see which user has uploaded which file, but an outsider that has no rights to see the directory index would never be able to guess the name of a file. No authentication needed.
I have a table with in it documents with their filelocation ie url. What can I use /do to open this document in the browser ? Or when this is an ms office file in word or excel?
A quickwin but probably expensive solution is to upload or your files to googledrive by API (https://developers.google.com/drive/v2/reference/) with restrictive permissions (a unique authkey per file) then you iframe the google drive's url in your webapp.
This is expensive as if you have many users/files, you'll need more space on google drive.
If your users are signed in using google, then it's better for security as instead of an authkey you can handle permissions by email.
Otherwise, you can use some javascript word/excel editor like http://webodf.org/.
Hope it helps!
Younes for Wishtack.com
I want to store the data into my app locally and just read the data when the user searches. For example the flag and its country name.
If you mean you want to put a pre-populated db in your app there's some instructions here on how to include it and how to read from it:
http://msdn.microsoft.com/en-us/library/windowsphone/develop/hh286411(v=vs.105).aspx
If that's not what you meant and you want to be able to read and write from a db in your app there's some links on that page too.
Using PHP, does anyone know how to make it so that when someone registers on a website (and therefore enters data into a database), a folder with a default php file is created on the web root/server???
This is not a good design. Rather, you should have your PHP files look at the session to find the logged in user's id, and query the necessary data about that user id. You don't need a file for each user. You can make your table auto-increment a user id.
Pretty basic question but I haven't been able to find an answer. Using Transit I can "move" files from one S3 bucket on one AWS account to another S3 bucket on another AWS account, but what it actually does is download the files from the first then upload them to the second.
Is there a way to move files directly from one S3 account to another without downloading them in between?
Yes, there is a way. And its pretty simple, though it's hard to find it. 8)
For example, suppose your first account username is acc1#gmail.com and second is acc2#gmail.com.
Open AWS Management Console as acc1. Get to the Amazon S3 bucket properties, and in the "Permissions" tab click "Add more permissions". Then add List and View Permissions for "Authenticated Users".
Next, in AWS IAM (it's accessible from among the console tabs) of acc2 create a user with full access to the S3 bucket (to be more secure, you can set up exact permissions, but I prefer to create a temporary user for the transfer and then delete it).
Then you can use s3cmd (using the credentials of the newly created user in acc2) to do something like:
s3cmd cp s3://acc1_bucket/folder/ s3://acc2_bucket/folder --recursive
All transfer will be done on Amazon's side.
Use the aws cli (I used ubuntu 14 ec2 instance) and just run the following command:
aws s3 sync s3://bucket1 s3://bucket2
You will need to specify the account details for one, and have public write access or public read access to the other.
This will sync the two buckets. You can use the same command again later to sync quickly. Best part is that it doesn't seem t require any bandwidth (e.g. files are not passing through local computer).
If you are just looking for a ready made solution there are a few solutions out there that can do this. Bucket Explorer works on Mac and Windows and can copy across accounts as can Cloudberry S3 Explorer and S3 Browser but they are Windows only so may not work for you.
I suspect the AWS console could also do it with the appropriate permissions setup but I haven't tested this.
You can also do it using the AWS API as long as you have given the AWS account you are using write permissions to the destination bucket.
boto works well. See this thread. Using boto, you copy objects straight from one bucket to another, rather than downloading them to the local machine and uploading them to another bucket.
Move S3 files from One account to another account
Let's consider there are two accounts source account and destination account. And two buckets source-bucket and destination bucket. We want to move all files from source-bucket to destination-bucket. We can do it by the following steps:
aws configure
Configure your destination account using the credential or the IAM role.
Create user policy for the destination account user.
Give destination user access to the source-bucket by modifying the source-bucket policy and adding destination account user policy into it. By this way, destination user will have the access to source-bucket.
aws s3 ls s3://source-bucket/
this will check whether the destination account is having access to source-bucket. Just for confirmation do this.
aws s3 cp s3://source-bucket s3://destination-bucket --recursive
this will copy source-bucket all files to destination-bucket. All files are copied using --recursive flag.
aws s3 mv s3://source-bucket s3://destination-bucket --recursive
this will move all the files from source-bucket to destination-bucket.
Alternative you can use the sync command
- aws s3 sync s3://source-bucket s3://detination-bucket
For Better Explanation follow the link
On Mac OS X I used the Transmit app from Panic. I opened one window for each S3 account (using the API Keys and secrets). I could then drag from one bucket in one window to another bucket in the other window. No need to download files locally first.
Andrew is correct, Transmit downloads the files locally then uploads the files.
CrossFTP can copy S3 files straight from one bucket to another without downloading them. It is a GUI S3 client that works on Windows, Mac, and Linux.
You can user Cyberduck (open source)
For newly created files (NOT existing objects), you can take advantage of new functionality from AWS. It is Cross-Region Replication (under "Versioning" for the S3 bucket). You can create a policy that will allow you to replicate new objects to a bucket in a different account.
For existing objects, you will still need to copy your objects using another method - unless AWS introduces native functionality for this in the future.
One can so it with running following :
aws s3 mv (sync for keeping buckets in sync) s3://source-bucket s3://destination-bucket --recursive
Attach a bucket policy to the source bucket in Source Account.
Attach an AWS Identity and Access Management (IAM) policy to a user or role in Destination Account.
Use the IAM user or role in Destination Account to perform the cross-account move.