tomitrescak/meteor-uploads

Secure file access

Closed this issue · 1 comments

Hi Tomi, Thank you for your great work and the support you have shown in this community.
I am having an issue regarding security and could not find anything in documentation.
I know that validateRequest runs out of Meteor fiber so UserID and DB is not accessible.

The only thing I can think of is filename encryption, maybe just an id or a random number can do the job.
Is there a way to modify filename before uploading it(so users that have permission to some files do not access other files by guessing there name)?

It seems to me that this might solve security access issue in some acceptable degree.

I have posted a long version of this issue in SO.
An example will be great.

Thanks for you time!

Managed to fix this issue with "getFileName". Thanks for you work