#2143 new enhancement

Adding aliases to the WUI

Reported by: multikatt Owned by: daira
Priority: normal Milestone: undecided
Component: code-frontend-web Version:
Keywords: wui, alias Cc: amontero@…
Launchpad Bug:


I've submitted a pull request on https://github.com/tahoe-lafs/tahoe-lafs/pull/80 which makes aliases to be listed just under "View File or Directory" on the welcome screen.

markberger commented on github that he "think it's important that this behavior be opt-in since you are exposing aliases." At this point it does not, but i could probably make it configurable in tahoe.cfg.

Also note that at this time it just does a very simple listing of all available aliases, it would be neat to be able to delete, add or hide specific aliases. Before doing that I'd like to know if this is at all something that should be implemented.

Change History (5)

comment:1 Changed at 2013-12-28T14:10:46Z by daira

Unfortunately this functionality can't be included, because the welcome page is at a guessable URL and so it is insecure for it to contain secrets. There are plans to have a WUI "control panel", separate from the welcome page and at an unguessable URL, that could have links to aliases.

comment:2 Changed at 2013-12-29T00:23:33Z by amontero

@multikatt: Since aliases contain sensitive information, disclosing anything on it would be a great security risk. However, I think that achieving a WebUI aliases directory could be interesting for some scenarios.

Reading them from other file different than "private/aliases", such as "public_html/webui_aliases" or something to be discussed further, might be a nice compromise.

comment:3 Changed at 2013-12-29T00:23:55Z by amontero

  • Cc amontero@… added

comment:4 Changed at 2013-12-29T02:37:25Z by zooko

There is discussion of this on the pull request. Here is a copy of my contribution:

Dear multikatt: thank you very much for the patch. I, too, would like to see this added to the WUI in a safe way. If I understand correctly, the current patch, with the "people can only connect to the WUI from localhost" security feature in place, is exactly the situation we had in Tahoe-LAFS v0.5, which Nathan Wilcox then demonstrated a live exploit for that could delete or otherwise alter a user's data!


The solution that we deployed in Tahoe-LAFS v0.5.1 was to remove this feature, which if I understand correctly is the feature that your patch puts back in! ☺

I think the way forward, as Daira alluded in https://github.com/tahoe-lafs/tahoe-lafs/pull/80#issuecomment-31296775, is to implement #674 (“controlled access to your WUI”). With that implemented, then we could safely add aliases to the WUI.

comment:5 Changed at 2014-09-11T22:24:53Z by warner

  • Component changed from unknown to code-frontend-web
Note: See TracTickets for help on using tickets.