topic Re: 5.0.d security issue with internet download manager in Alfresco Archive

5.0.d security issue with internet download manager

samirastucia — Wed, 27 Jan 2016 17:09:02 GMT

Hello every body,I made an alfresco 5.0.d new installation in windows server 2012 R2, i revoked the download action for site consumers, but for those who have IDM (internet download Manager installed in their browser), the browser promt for download the pdf file even if there is no download button.C

Re: 5.0.d security issue with internet download manager

afaust — Thu, 28 Jan 2016 09:07:36 GMT

Hello,

if you don't want tools like IDM to be able to offer download to those types of restricted users, you must completely remove any potential URL reference to the actual document download from the page. This also includes disabling the PDF / document previewer which internally "downloads" fragments of the document for display and uses an URL reference that would allow full download. IDM very likely picks up this URL and provides the download option based up on that.

Regards
Axel

Re: 5.0.d security issue with internet download manager

samirastucia — Thu, 28 Jan 2016 15:41:42 GMT

Thank you Axel for your reply,

What if we use a SWF previwer instead of the pdfjs ?

Re: 5.0.d security issue with internet download manager

afaust — Thu, 28 Jan 2016 16:54:58 GMT

The SWF previewer would likely still result in IDM providing a download option, but the downloaded file will be a reduced quality rendition of the original document.

Technically, as long as you expose any previewer capability, IDM is likely to provide something to download. Even if that is only a rendition, the URL provided can be manipulated by users to still download the original document. Everything you are doing to restrict the ability of download is only UI focussed. Technically, if a user has READ access to a document inside Alfresco and is somehow able to piece together the URL to it, they can download it (the URLs aren't that complex either).

Regards
Axel