We just noticed that google broke through our access control an indexed some webfm files that were supposed to be accessible only to authenticated users of a particular role. Perhaps while while switching from TAC to content_access the guard was down and these webfm files were crawled by google.

So I notice that even though access to my pages is restricted that if the path to the webfm file is know that an unauthenticated user can still access the file. yikes!

My configuration is set with webfm as public, user perms for 'view webfm attachments' open to unauthenticated users, and the default file perm flag also open to the public. So I guess I shouldn't be surprised that the public could view the file IF they knew the URL. I probably was protected by obscurity alone until google dodged in the open hole.

So now I added user perms for 'access webfm' to the authenticated user, set their perms at admin/settings/webfm, and created the folder webfm/authenticated. I then have moved all privileged content into this folder. The webfm browser works great for this. My plan with this simple scheme is to keep crawlers out of all privileged, keep authenticated users off of pages with role permissions, and keep authenticated users away from direct access to webfm files through obscurity.

Now that I have moved all privileged content into the 'authenticated' folder my main challenge is that I have to edit the perms on each individual file. Double yikes! Should would be cool to have a folder access perms or a multiple file or batch perms function. Feature request!

Thanks for any help or counsel.

Comments

cgmonroe’s picture

cgmonroe commented

The best way to check/fix permission of a large scale is to just do it via the DB.

They are stored in the perm column of webfm_files table. This is a "flags" column that uses the following bits:

// file access bits
define('WEBFM_FILE_ACCESS_PUBLIC_VIEW', 1); //publicly viewable via webfm_send link
define('WEBFM_FILE_ACCESS_ROLE_VIEW', 2);   //role can view/download file (owner/admin can always view)
define('WEBFM_FILE_ACCESS_ROLE_ATTACH', 4); //role attach permitted (owner/admin can always attach)
define('WEBFM_FILE_ACCESS_ROLE_FULL', 8);   //role modification of file permitted (owner/admin can always modify)
define('WEBFM_MAX_FILE_ACCESS', WEBFM_FILE_ACCESS_PUBLIC_VIEW + WEBFM_FILE_ACCESS_ROLE_VIEW + WEBFM_FILE_ACCESS_ROLE_ATTACH + WEBFM_FILE_ACCESS_ROLE_FULL);

Basically, if the value in this field is an odd number, then it is publicly viewable. You could use a set of SQL statements to fix this. E.g.:

UPDATE webfm_file Set PERM=0 where PERM=1
UPDATE webfm_file Set PERM=2 where PERM=3

and the like.

Note: Backup stuff first, make sure my quick and dirty from memory SQL works.

webservant316’s picture

webservant316 commented

Thanks for the tip. 30 minutes by hand and I am done. However, I do let the feature request stand. Seems like batch functions on all files contained in a folder could be very useful.