whizvox / onetimedownload Goto Github PK

0.0 2.0 0.0 603 KB

File sharing web service that allows only 1 download per file. Live demo at 1tdl.com

Java 65.21% CSS 0.03% JavaScript 17.89% HTML 16.86%

java jquery spring-boot thymeleaf

onetimedownload's Introduction

One-Time Download (1TDL)

A file-sharing service that allows only 1 download per file. All uploaded files are password-encrypted and require the correct password to download.

Run/Test Environment Configuration

Run working directory: ./run (included in .gitignore)
Run properties file: ./run/application.properties
Test working directory: ./test (included in .gitignore)
Test properties file: ./test/application.properties

Data Source Configuration

MySQL

spring.datasource.username=<username>
spring.datasource.password=<password>
spring.datasource.url=<url>
spring.jpa.hibernate.ddl-auto=update (recommended for testing)

Storage Configuration

AWS S3

otdl.storage.module=s3
otdl.storage.s3.region.static=<region code>
otdl.storage.s3.credentials.access-key=<access key>
otdl.storage.s3.credentials.secret-key=<secret key>
otdl.storage.s3.bucket-name=<bucket name>

Local File System

otdl.storage.module=local
otdl.storage.local.location=<path>

Email Configuration

otdl.email.enable=<true|false> (default: false): If true, remaining settings must be defined
otdl.email.host=<host name>
otdl.email.port=<integer>: 25 or 587 is recommended for SMTP
otdl.email.username=<username>
otdl.email.password=<password>
otdl.email.protocol=<protocol> (default: smtp)
otdl.user.email-from-address=<user>@<mail server host name>
otdl.user.email-confirm-host=<service host name>

onetimedownload's People

Contributors

Watchers

onetimedownload's Issues

Upload page's input validation should be checked after each typed letter

The submit button is only enabled/disabled after the end user changes focus of either of the password fields. Better feedback when checked after each keystroke.

Submit buttons on upload and download should be disabled after clicking

Using Thymeleaf's insert tag produces TemplateInputException when running as JAR

Every template that uses this kind of syntax (i.e. profile, control_create_user, about):

<html th:insert="fragments/standard_page :: page(~{ :: .main-content})">

raises the following exception when running in a production environment:

ERROR [https-jsse-nio-443-exec-4] org.thymeleaf.TemplateEngine             : [THYMELEAF][https-jsse-nio-443-exec-4] Exception processing template "control_create_user": Error resolving template [/fragments/common], template might not exist or might not be accessible by any of the configured Template Resolvers (template: "fragments/standard_page" - line 4, col 7)
org.thymeleaf.exceptions.TemplateInputException: Error resolving template [/fragments/common], template might not exist or might not be accessible by any of the configured Template Resolvers (template: "fragments/standard_page" - line 4, col 7)

This does not happen during development.

Upload route allows empty files

Not specifying a file and putting some password in the upload form is apparently valid input for both the controller and service, since there is a file, it just doesn't have any content. This shouldn't be allowed.

Allow specification of file lifetime and file expiration time

Currently, file lifetimes are set at 60 minutes (via hidden field) and set to expire after download after 15 minutes. Allow logged in users to change both of these.

Add password reset functionality

User is effectively locked out of their account if they don't remember their password. Add "Forgot password" button to login page and allow user to reset their password via secure link to their email inbox.

403 response when accessing JSON API when CSRF is enabled

Have to modify all AJAX requests to account for this rather than just adding more URLs to the ignore list.

Verify email confirmation

Ground work for email confirmation is set up, but not verified to actually yet work.

Trouble uploading large files

Trying to upload a large file (>~10 MB) results in a net::ERR_CONNECTION_RESET result in my environment (Windows 11 / Brave). Unsure what's causing this.

Account verification not possible if email is changed

If a user changes their email address, there is currently no option to, nor is there a verification link sent to the new email address. Add a button to allow this in the profile details page.

Add option for browser to store credentials

Currently, a logged in user is logged out when they close their browser. There should be a "Remember me" checkbox when logging in which will store the credentials in the browser, allowing for persistent sessions when closing and reopening.

Need contact and about pages

/contact and /about are linked in the footer, but results in a 404 for both routes. Don't know whether to hardcode the content of these pages or allow webmaster to edit external format/template files.

Add admin-only control panel

Aside from the temporary debug route, there doesn't currently exist any way for anyone to edit the site without accessing AWS services or the database. Should add a control panel that is only accessible to admins to allow adding, deleting, viewing, or updating resources.

All @Spec arguments relating to LocalDateTime aren't being parsed correctly

How to replicate:

Upload file
Go to /control/files
Search for files utilizing "Uploaded after" or "Uploaded before" fields
No files are returned, no exception is thrown

Even forcing an exception with onTypeMismatch = OnTypeMismatch.EXCEPTION in the spec definition doesn't yield any different behavior. I suspect the suspect @Spec arguments need some weird format to actually parse.

Fallback error page shown upon 404 in /view

Trying to view the details of a file via /view/{id} yields a fallback error page. Should change this to a specialized error page.

Anonymous users allowed to set lifespans meant for members

Anonymous users should have a lifespan limit of 60 minutes, while members should have a limit of 24 hours. However, the controller doesn't check for this and the underlying service assumes any user is a member. This allows any anonymous member to set lifespans up to 24 hours.

Encrypt sensitive fields in external application.properties

Certain field values that exist in the application.properties file (i.e. passwords, secret access keys, IP address, etc.) should not be viewable in plaintext. The Jasypt library looks to be an ideal solution.

No input validation for login or registration forms

Currently no feedback is communicated to the end user if they input an invalid value for any of the fields in the /login or /register pages.

Use HTML input validation as much as possible
Use jQuery as a backup
Display server-sent error messages in browser

Unverified users should not be granted user-specific permissions

While email verification is functional, whether the user's email is verified or not doesn't actually affect their experience using the site. They should be treated as guest/anonymous users until their email is verified.

/files/delete POST and /files PUT route open to anyone

There is no authentication that happens when accessing the bulk delete files or update file route. It is not accounted for in the web security configuration, nor does the router have any @PreAuthorize annotation. This should absolutely not be the case, and should only be available to admins.

Add account view and allow logged in user to change account details

Currently end users can create accounts and can log in and log out of them, but cannot view their details, edit any of their details, nor check on their uploaded files.