• Welcome to the Chevereto User Community!

    Here, users from all over the world come together to learn, share, and collaborate on everything related to Chevereto. It's a place to exchange ideas, ask questions, and help improve the software.

    Please keep in mind:

    • This community is user-driven. Always be polite and respectful to others.
    • Support development by purchasing a Chevereto license, which also gives you priority support.
    • Go further by joining the Community Subscription for even faster response times and to help sustain this space

Disable remote upload

D

devon

Chevereto Noob
Can I disable remote upload images (via url) in panel ? I do not want to show my IP.
Cloudflare said:
Never initiate an outbound connection based on user action.
If the attacker can get your web server to connect to an arbitrary address, they will reveal your origin IP. Features like "upload from URL" that allow the user to upload a photo from a given URL should be configured so that the server doing the download is not the website origin server. This is important because if an attacker can choose the URL entered, they can set up a web site specifically to monitor who connects to it, or use a public service that monitors the IPs that contact unique URLs.
Click to expand...
 
devon said:
Can I disable remote upload images (via url) in panel ? I do not want to show my IP.
Click to expand...

Oh.. is this/this is something to worry about, security wise?


(And.. hi there, nice to meet you all! just signed up here to learn about chevereto.. intend buy a license 🙂)
 
TimT said:
Oh.. is this/this is something to worry about, security wise?
Click to expand...

Is more privacy wise than security, remote uploads could detect the server IP running Chevereto and for people hosting some illegal content it could be a problem because you can detect the real server IP. I don't like the idea of Chevereto being used for illegal activities or to conceal illegal activities, remove remote uploads will help those doing this kind of activities.

But, this also allows attackers to get your real server IP and issue several types of attacks.

In both scenarios is a problem.
 
you do realize that's idiotic? why would you give attackers a way to "resolve" backend ip? this is a security issue for many people, anyone can resolve ip and ddos site and cause downtime for people who just use cloudflare as a reverse proxy to hide backend
 
Most likely this will be configurable in V4.

By the way, hiding your real IP is the lazy way to deal with ddos. What kind of protection is obscuration anyway? It is a server, not a toy. You can put a firewall on top of it, in fact, it is standard to have a ddos firewall nowadays and any large production website should have firewall.
 
So what is the way to only permit upload via the API? A friend is using one of my chevereto instance to upload image to his iOS app (he is a dev) and he wants to remove access to the website (for moderation purpose), so there is no way to use the API only?
 
You could always customize the routes, the forms, the everything.

Literally you can achieve everything someone ever suggested or requested, the problem is that while some editing is easy as touching one line, other stuff is way harder and complicated. What you have to realize is that V3 was made to be a customizable solution by proving turnkey options, not pluggable code.

LibreArbitre said:
So what is the way to only permit upload via the API?
Click to expand...
Disabling uploads and creating a custom API for your need.
 
You must log in or register to reply here.
Back
Top