Private data is publicly visible at /uploaded/layers

[jondoig]

In Geonode 2.4, all uploaded data can be listed and downloaded from http://<host>/uploaded/layers regardless of security permissions.

This seems to be by design. The installation doco says to make it all wide open:

sudo chmod -Rf 777 /home/geonode/geonode/geonode/uploaded/thumbs
sudo chmod -Rf 777 /home/geonode/geonode/geonode/uploaded/layers

Removing ‘other’ permission (chmod 770) breaks the upload function.

[jondoig]

At least we can make it a bit harder by denying directory listing in the Apache config. I.e. change the installation doco from:

    <Directory "/home/geonode/geonode/geonode/uploaded/layers/">
        Order allow,deny
        Options Indexes FollowSymLinks
        Allow from all
        Require all granted
        IndexOptions FancyIndexing
    </Directory>

to

    <Directory "/home/geonode/geonode/geonode/uploaded/layers/">
        Order allow,deny
        Options -Indexes +FollowSymLinks
        Allow from all
        Require all granted
    </Directory>

(...and same for the other directories configured there.)

But it's still not hard to infer the actual filenames (if just the metadata is visible) and download them without listing the directory.

[simod]

Hi, the uploaded/layers directory doesn't have to be served by apache, it only needs write permissions. Thumbs on the other hands need to be publicly available. If the doc says that uploaded has to be served then we need to fix it.

Thanks

[jondoig]

OK so I've made a pull request to fix the manual install doco, but the same change may be needed to other install methods ...Quick install? Ansible? Other?

[simod]

Thanks I've also fixed it at package level see dedd939