Public access to issue attachments

Hi all,

We've recently switched to Redmine for managing internal tasks/workflow for our web design company.

We use another system for interacting with our customers, and often need to show them images/mockups/etc that are stored in our Redmine as attachments to issues

When not logged in to Redmine, accessing the attachment file links causes a redirect to the login screen.

How can this be overridden without removing authentication requirements on the rest of the system, and without needing to give our customers usernames/passwords to our Redmine?

I don't know RoR (PHP guy, me) and having a play in attachments_controller.rb hasn't shed much light on it for me.. I can see where it's using :check_project_privacy to see if permission to access the link is granted or not, and I've tried removing the reference to it and restarting redmine app, but no luck.

Can anyone suggest how I can remove authentication requirements on attachment links?

Kind regards,
David

Replies (5)

RE: Public access to issue attachments - Added by David Roper over 15 years ago

Anyone? Willing to throw some cash at it, if needed!

Regards,
David

RE: Public access to issue attachments - Added by Thomas Lecavelier over 15 years ago

You should consider a more sysadmin based solution: just expose publicly the files directory of your redmine to your webbrowser (via a symlink or a mount -bind), this should be far lighter than hacking redmine and introduce a security hole in your instance.

RE: Public access to issue attachments - Added by David Roper over 15 years ago

We need a way to generate the links automatically from within redmine somehow, as manually hunting for the right files would be just as tedious as download/re-upload.

Perhaps a solution that places a second link next to each attachment link with a direct-download link for the files?

I don't really care about how it's done, as long as our administrators (who aren't sysadmins or techy people) can generate a link with no more than two clicks, right from redmine, and copy/paste it to our clients.

I'm willing to pay for a solution to this, and it's become very urgent.

Regards,
David

RE: Public access to issue attachments - Added by Thomas Lecavelier over 15 years ago

So, here a solution: withdraw login-requirement on attachments controller.

It was made via tortoiseSVN, as I think you're under windows.

No need to modify links, just copy and paste the ones provided by redmine: with this patch, redmine won't request login to display ANY attachements store in redmine issues.

For other users: please, please, please... Don't use that patch if your redmine instance is exposed to internet with sensible matter in it.

David Crow, if you think this patch is business saving, please consider make donation to jplang paypal account (jp_lang at yahoo dot fr, for redmine creation) and/or maybe to mine (tslh1806 at gmail dot com, for providing support for redmine). Notice that I don't and I'll NEVER ask any money for ANYTHING concerning redmine. But I accept donations :)

Thomas.

Withdraw_attachmentscontroller_login_need.patch (503 Bytes) Withdraw_attachmentscontroller_login_need.patch

TortoiseSVN_patch to withdraw login-requirement on attachements

RE: Public access to issue attachments - Added by Anoop L about 15 years ago

Hi....

I need a help in something like this. We got web designs as attachments in a zipped folder. How can view allow our Redmine users to view the attachments without downloading for previews. I tried the Redmine plugin called 'Embedded' but that was not much useful since it allows to use a set of html designs( say alpha 1 , alpha 2 etc....

I dont have that much logic or experience to reslove this.

Guys Please help me.

Thanks

(1-5/5)

Project

General

Profile

Redmine