Project

General

Profile

Development #73481

audit: enregistrer les accès aux fichiers "distants" (redirection)

Added by Thomas Noël 2 months ago. Updated 2 months ago.

Status:
Nouveau
Priority:
Normal
Assignee:
-
Target version:
-
Start date:
17 January 2023
Due date:
% Done:

0%

Estimated time:
Patch proposed:
No
Planning:
No

Description

Pour l'audit sur l'accès aux fichiers actuellement on fait dans wcs/forms/common.py :

class FileDirectory(Directory):
    ...
    def _q_lookup(self, component):

        ... 
        if file.has_redirect_url():
            redirect_url = file.get_redirect_url(backoffice=get_request().is_in_backoffice())
            if not redirect_url:
                raise errors.TraversalError()
            redirect_url = sign_url_auto_orig(redirect_url)
            return redirect(redirect_url)                             <-- pas d'audit dans ce cas

        if not self.thumbnails:
            # do not log access to thumbnails as they will already be accounted for as
            # a view of the formdata/carddata containing them.
            audit('download file', obj=self.formdata, extra_label=component)             <-- audit sur l'accès direct
        return self.serve_file(file, thumbnail=self.thumbnails)

En cas de redirect on n'enregistre rien. On pourrait avoir un type "download file (redirect)" ou "download file (remote)".

Also available in: Atom PDF