topic Security in Alfresco files in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/security-in-alfresco-files/m-p/292544#M245674 <HTML><HEAD></HEAD><BODY><SPAN>Hi,</SPAN><BR /><BR /><SPAN>&nbsp;&nbsp; I am currently using Alfresco Community version 4.2 and have observed one potential security concern. When a file is uploaded in Alfresco, it gets uploaded&nbsp; to the 'contentstore' in date wise folder structure. Thus, when I uploaded a '.png' image today (04-Apr-2016) it got saved in the folder "alf_data/contentstore/2016/4/4/13/40/c431a2e1-f90f-49be-ab7b-b70a7544cac9.bin". When I physically go to this location and download the '.bin' file and open it I could see the file contents as it is. Moreover, if the extension is changed to '.png', the file open properly as an image file and thus user is able to see and modify all the data at back end. Sometimes, as an IT service provider, we do have to give the credentials of the Admin user in Alfresco to our customer and they can modify the data. This appears to be a major security concern. Can someone suggest a solution on this in the Community version itself. </SPAN><BR /><BR /><SPAN>Regards,</SPAN><BR /><SPAN>&nbsp;&nbsp; Omkar</SPAN></BODY></HTML> Mon, 04 Apr 2016 09:14:58 GMT omkar 2016-04-04T09:14:58Z Security in Alfresco files https://connect.hyland.com/t5/alfresco-archive/security-in-alfresco-files/m-p/292544#M245674 Hi,&nbsp;&nbsp; I am currently using Alfresco Community version 4.2 and have observed one potential security concern. When a file is uploaded in Alfresco, it gets uploaded&nbsp; to the 'contentstore' in date wise folder structure. Thus, when I uploaded a '.png' image today (04-Apr-2016) it got saved in the folder Mon, 04 Apr 2016 09:14:58 GMT https://connect.hyland.com/t5/alfresco-archive/security-in-alfresco-files/m-p/292544#M245674 omkar 2016-04-04T09:14:58Z Re: Security in Alfresco files https://connect.hyland.com/t5/alfresco-archive/security-in-alfresco-files/m-p/292545#M245675 <HTML><HEAD></HEAD><BODY><SPAN>Hello,</SPAN><BR /><BR /><SPAN>this is only a security issue for specific use cases and can be easily dealt with. The Alfresco system supports configuration of how / where Alfresco stores its content and you could always set up storage in a way that a normal (admin) user has access to the Alfresco system but not access to the actual content store using either filesystem-level permissions or different storage mechanisms (i.e. store content in a content addressed storage (CAS) system). See &lt;a href="</SPAN><A href="http://docs.alfresco.com/5.1/concepts/manage-cs-home.html" rel="nofollow noopener noreferrer">http://docs.alfresco.com/5.1/concepts/manage-cs-home.html</A><SPAN>"&gt;Setting up ContentStores&lt;/a&gt; from the (Enterprise) documentation, which also applies to Community except that the actual content store implementations may not be available in Community (but can be implemented and plugged in by any Java developer).</SPAN><BR /><BR /><SPAN>Regards</SPAN><BR /><SPAN>Axel</SPAN></BODY></HTML> Mon, 04 Apr 2016 13:15:10 GMT https://connect.hyland.com/t5/alfresco-archive/security-in-alfresco-files/m-p/292545#M245675 afaust 2016-04-04T13:15:10Z