Different URL for generated links

[assices]

Different URL for generated links

[pglombardo]

Hi @assices - Having all shared links under a common share path would be nice but we don't have that today. But you should be still able to block on paths already.

BTW: Are you aware of:PWP__ALLOW_ANONYMOUS and PWP__DISABLE_SIGNUPS in the Configuration documentation? It's another way to limit access. Requires logins.

Here is the overly detailed list with HTTP methods to allow anonymous access to. It's slightly more complicated as well because of the locale support in URLs.

Text based pushes

• GET /p/:id
• DELETE /p/:id (for "Allow users to delete this push once retrieved." option)
• GET /p/:id/r
• GET /p/:id/passphrase
• POST /p/:id/access
• GET /:locale/p/:id
• DELETE /:locale/p/:id (for "Allow users to delete this push once retrieved." option)
• GET /:locale/p/:id/r
• GET /:locale/p/:id/passphrase
• POST /:locale/p/:id/access

URL based pushes

• GET /r/:id
• DELETE /r/:id (for "Allow users to delete this push once retrieved." option)
• GET /r/:id/r
• GET /r/:id/passphrase
• POST /r/:id/access
• GET /:locale/r/:id
• DELETE /:locale/r/:id (for "Allow users to delete this push once retrieved." option)
• GET /:locale/r/:id/r
• GET /:locale/r/:id/passphrase
• POST /:locale/r/:id/access

File based pushes

• GET /f/:id
• DELETE /f/:id (for "Allow users to delete this push once retrieved." option)
• GET /f/:id/r
• GET /f/:id/passphrase
• POST /f/:id/access
• GET /:locale/f/:id
• DELETE /:locale/r/:id (for "Allow users to delete this push once retrieved." option)
• GET /:locale/f/:id/r
• GET /:locale/f/:id/passphrase
• POST /:locale/f/:id/access

It depends on what features you have enabled on your instance but general path rules somewhat like the following would work:

location /p/ {
    allow  all;
}
location /en/p/ {
    allow  all;
}

If you want a raw dump of all routes of the application, from inside the Docker container run rails routes.

[assices]

Thanks Peter,

I think it's quite difficult to block shared links only by URL path without risking blocking other user management functions.

An example:

Shared link (public access)
https://pwpush.example.com/it/p/of7xq0slito7wgps8w

user management links (restricted access)
https://pwpush.example.com/it/p/of7xq0slito7wgps8w/anteprima
https://pwpush.example.com/it/p/of7xq0slito7wgps8w/controllo
https://pwpush.example.com/it/p/scaduto
https://pwpush.example.com/it/p/attivo

Anyway, I'll do some tests.

Yes, I evaluated PWP__ALLOW_ANONYMOUS and PWP__DISABLE_SIGNUPS options, but I would like leave both Anonynous and Signups enabled for company employees only.

Thanks again for informations.
Ciao, Andrea