As far as I understand, attachments can be accessed in two different
ways:
* They live in gitlab/public/uploads/note/attachment/... and from
there they can be served as static resources by the web server.
* They can also be accessed through Unicorn
as /files/notes/attachment/...
The issue with serving them as static resources is that it's not obvious
to set any useful access control since the web server doesn't know about
user credentials. OTH when these attachments are accessed through
Unicorn gitlab does enforce some access control (for instance, it won't
display attachments for private projects unless the user can access the
project).
On my servers I have added redirections to redirect
"^/uploads/([^/]*)/attachment/(.*)$" to "/files/$1/$2" so that people
can't access attachments as static resources and that seems to do the
trick.
Hope this helps.
Eric
Le vendredi 17 janvier 2014 à 06:42 -0800, [email protected] a écrit :
> I too would love to have this issue solved.
>
> To try to host doxygen documentation via gitlab, I figured out where
> the wall uploads were put. I use the construct of "upload an image to
> the wall and link to it in the wiki" to have images in the wiki.
>
> Hosting doxygen pages this way works great, but I will now need to
> remove the doxygen pages and the images I use in the wiki since they
> are absolutely not meant to be publicly accessible.
>
>
> --
> You received this message because you are subscribed to the Google
> Groups "GitLab" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to [email protected].
> For more options, visit https://groups.google.com/groups/opt_out.
--
You received this message because you are subscribed to the Google Groups
"GitLab" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
