taigaio / taiga-back

77%

master: 81%

LAST BUILD ON BRANCH attachments

branch: attachments

CHANGE BRANCH

x

Reset

• attachments
• 1.1.0
• 1.1.1
• 1.1.2
• 1.10.0
• 1.2.0
• 1.4.0
• 1.5.0
• 1.6.0
• 1.7.0
• 1.8.0
• 1.9.0
• 1.9.1
• 190913-fix
• 190917-md-refresh-attachment
• 191028-upgrade-requirements
• 191226-order-by
• 2.1.0
• 200127-i18n-lv
• 200205-fix
• 200217-update-requirements
• 200224-explicit-close
• 200227-bug
• 200227-update-requirements
• 200305-update-requirements
• 200402-add-contact-email
• 200402-heisentest
• 200423-update-requirements
• 200430-pip-tools
• 3.0.0
• 3.1.0
• 3.1.2
• 3.1.3
• 3.2.0
• 3.2.0rc
• 3.2.2
• 3.2.3
• 3.3.0
• 3.3.0rc
• 3.3.1
• 3.3.10
• 3.3.11
• 3.3.12
• 3.3.13
• 3.3.14
• 3.3.15
• 3.3.16
• 3.3.2
• 3.3.3
• 3.3.7
• 3.3.8
• 3.3.9
• 3.4.0
• 3.4.0rc
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0rc
• 4.1.0
• 4.1.1
• 4.2.0
• 4.2.1
• 4.2.10
• 4.2.11
• 4.2.12
• 4.2.14
• 4.2.15
• 4.2.1rc
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2rc
• 5.0.0
• 5.0.1
• 5.0.10
• 5.0.11
• 5.0.12
• 5.0.13
• 5.0.14
• 5.0.15
• 5.0.2
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.0rc4
• 5.0rc5
• 5.0rc6
• 5.5.0
• 5.5.1
• 5.5.2
• 5.5.3
• 5.5.4
• 5.5.5
• 5.5rc
• Adding-blocked-code-project-info-to-watched-like-and-voted
• Adding-dates-to-csv-issues-report
• Adding-project-info-on-slots
• Allowing-export-project-even-if-any-file-doesnt-exist
• Enabling-console-output-again
• Enabling-lowercase-for-username-or-email-when-allowed
• Enhancement/3307/improve-sprint-burndown-graph
• Fixes-CharField-behaviour-and-introduces-proper-validation-for-ModelField
• Fixing-deadlocks-on-update_attr_in_bulk_for_ids
• Fixing-empty-body-bug-in-github-webhooks
• Fixing-empty-body-bug-in-gitlab-webhooks
• Fixing-on_new_history_entry-signals
• Fixing-serializers-validation-for-duplicated-names-in-priorities-severities-and-issue-types
• Fixing-webhooks-tests-call-if-the-response-inst-a-valid-json
• Fixng-error-messages-when-creating-membership-for-existing-user-in-the-project
• Import-export-projects-with-None-as-name-for-ProjectRelatedField
• Improving-API-performance
• Improving-HighLightedContentSerializer
• Improving-asynch-timeline-generation
• Improving-default-values-for-orders
• Improving-history-migration-0011
• Improving-memberships-serialization
• Improving-neighbor-calculation
• Improving-project-deletion
• Issue-2781-tagging-teammates-with-period-in-their-username
• Issue-3147-Remove-user.photo-file-on-anonimize
• Issue-3183-Error-when-uploading-an-avatar-with-a-name-of-254
• Issue-3543-Webhooks-problem-extracting-the-story-points-from-a-user-story
• Issue-3641-back-joining-milestone-task-change-and-the-next-change
• Issue-3783-hooks-origin-ips-configuration-allowing-networks
• Issue-3842-Catch-properly-invalid-IPs-errors-for-integrations
• Issue-4809-sorting-with-some-fields-with-filters-leads-to-incomplete-lists-with-duplicates-on-multiple-pages
• Issue/3445/to_tsquery-function-not-working-properly
• Issue/3448/finished-date-not-set-correctly-in-tasks
• Issue/4717/Attachments-in-cards-are-not-sorted-properly
• Refactoring-likes-votes-watchers-and-favourites-names
• Refactoring-tags-and-colors-in-API
• TG101
• U/320/T/529/add_avatar_to_filters
• U/320/T/529/add_user_photo_to_filters
• U/450/T/712/models_for_swimlane
• U/450/T/713/api_create_swimlane
• U/450/T/716/api_delete_swimlane
• U/450/T/735/api_edit_order_swimlane
• U/450/T/770/api_update_endpoints
• U/450/T/782/swimlanes_to_export_import
• U/467/T/471/review_settings
• U/467/T/472/dockerfile_entrypoint
• U/467/T/472/dockerfile_env
• U/467/T/587/install_contribs
• U/625/T/676/add_github_auth_contrib
• U/625/T/695/add_gitlab_auth_contrib
• US-2929-Ability-to-edit-comments
• US/2928-cards-ui-refactor
• US/3873/users-empty-avatars
• add-cache-to-history-entry-values-diff
• add-project-id-to-history-entries
• add-total-comments-to-kanban
• add-user-update-throttling
• add_events
• adding-by_username-endpoint-to-users-API
• adding-card-thumbnail-to-attachments
• adding-closed-milestones-counter-to-project-in-api
• adding-command-to-send-notification-messages
• adding-deleted-datetime-to-webhooks-when-deleting-elements
• adding-endpoint-to-bulk-update-milestone-for-user-stories
• adding-is_out_of_owner_limits-to-project-detail-serializer
• adding-management-command-to-block-projects
• adding-name-to-webhooks-and-logs-counter-to-API
• adding-only_relevant-filter-to-timeline-API
• adding-owner-info-to-project-serializer
• adding-tag-support-for-projects
• adding-tasks-and-attachments-to-userstory-listing-API-calls
• adding-transfer-validate-token-endpoint-to-the-API
• adding-user-creation-to-timeline
• alex-wip
• allowing-date-field-type
• api-improvements
• api-new-fields-for-home
• api-performance-1
• apps
• archived-milestones
• archived-us
• archived-userstory-status
• astagi-feature/addemailfield
• astagi-feature/attachments-sha1
• astagi-feature/themes
• astagi-feature/urlcustomfield
• attachments-on-comment
• attachments_import_fix
• auth-move
• avatar-refactor
• avoid-options-pre-flight
• better-project-slug-generation
• blocking-projects
• bug-2419-the-system-tries-sending-emails-to-inactive-users
• bug/1188/issues-text-search
• bug/1247/attachment-url-in-emails
• bug/1392/get-neighbors-for-empty-queryset
• bug/1393/failing-token-for-logged-users
• bug/1397/losing-role-points-when-deleting-role
• bug/1397/losing-role-points-when-deleting-roles
• bug/1438/error-when-import-export-finish-date-for-issues-and-user-stories
• bug/1466/projects-with-null-total-milestones
• bug/1484/problem-uploading-twice-the-same-files
• bug/1609/issues-neightbors
• bug/1647/delete-comments-by-project-owner
• bug/1668/fix-wiki-links-in-markdown
• bug/1700/delete-empty-memberships
• bug/1714/ordering-tasks
• bug/1736/get_object_or_404_return_500
• bug/1743/historic-deleted-users-appears-in-listings
• bug/1768/tags-with-special-chars
• bug/1783/fix-internal-wiki-urls
• bug/1849/wikilinks-problem
• bug/1972/tasks-should-retain-all-history-in-their-full-view
• bug/2083/user-story-history-repeats-files-and-has-no-order
• bug/2133/I-cannot-remove-myself-from-watchers
• bug/2150/bad-field-names-in-email-notifications
• bug/2390/public_project_listed
• bug/2444/links-in-rich-content-editor
• bug/2445/losed-stimations-when-deleting-values
• bug/967/error-500-when-creating-milestones
• bug/979/create-task-consistency
• bug/attachments
• bug/deprecate_django_method
• bug/disallow-owner-modification-on-api-requests
• bug/fix_project_history
• bug/importer-perrmisisons-and-memberships
• bug/race-condition-on-project-refresh-totals
• bug/userstories-in-timeline
• bugfixes
• bugs-post-django1.7
• burke-software-api-resource-ref
• calculating-neighbors-only-when-needed
• cancel-account-signal
• cancel-account-with-token
• cha/20250108/update-github-actions
• cha/20251121/migrate-from-raven-to-sentry-sdk
• cha/20251125/fix-epic-id-null
• change-email-from-link-for-anonymous-users-too
• change_star_project_to_like_project
• check-max-owner-memberships-when-creating-invitations
• chore/github-actions-migration
• chore/github-actions-migration-1
• chore/github-actions-migration-2
• commands/change_project_slug
• concurrency-control
• concurrent-queries-for-global-search-results
• contrib-plugins
• contributing
• dates-for-tasks-csv-reports
• delete-comments
• detecting-errors-properly-on-points
• disabling-most-signals-on-bulk-creation
• discover-improvements
• discover-mode-speedup
• django-version-update-bugfixes
• django1.7
• django1.7-step2-bugs
• django1.7-step3-order-refactor
• django17-deploy-step1
• django18_pytho35
• email-trans
• emit-events-fix
• enable_github_ci_in_taiga_6_branche
• endpoint-for-estimation-system
• endpoint-for-estimation-system-new
• endpoint-for-estimation-system-new-4.0
• enhancement/3758/include-gravatar-url-into-users-serializer
• enhancement/4356/import-gzipped-jsons
• enhancement/email-actions
• enhancement/featured_project_list_randomly_ordered
• enhancement/history-diffs
• enhancement/wiki/create_page_when_create_link
• error-on-unique-constraints-on-creation
• error-on-unique-constraints-on-creation-for-epic-related-user-stories
• events
• events-after-commit
• events-improvements
• export-import-serializer-validator-separation
• export-performance
• export_import
• external-references-change
• extra-api-migration
• feat/metrics_with_prometheus
• feat/prevent-membership-creation
• feat/unset-verfied-email-for-invited-users
• filter-by-email-domain-on-register
• filter-by-epics
• filter_fixes
• filtering-watchers-value-errors
• fix-dump-load-membership-uuid
• fix-duplicated-wiki-page-slugs
• fix-neighbor-null-value
• fix-project-members-photo
• fix-snapshot-not-null-restriction
• fix-sorting-projects-if-project-doesnt-exist
• fix-tests
• fix-throttling-bug
• fix-travis
• fix-warning-on-some-malformed-requests
• fix/change-max_members-to-max_memberships-in-user-model
• fix/load_and_dump_project_commands
• fix/move-can_is_private_be_updated-to-is_private_extra_info
• fix/notifications
• fix/project-detail-serializer-and-user-restrictions
• fix/project_owners_cannot_be_no_admin
• fix/transfer_project_to_no_admin_members
• fixed-members-filter
• fixes-on-transfer-project-amils
• fixing-admin-errors-and-making-it-usable-again
• fixing-and-refactoring-by-ref-api-endpoints
• fixing-attachments-with-long-names
• fixing-bad-valid-origin-configuration-for-gitlab-and-bitbucket
• fixing-chunk-deserializing
• fixing-contact-project
• fixing-created-datetime-for-timeline-entries
• fixing-deadlock-and-condition-race-errors
• fixing-delete-project-dump-asynch-task
• fixing-gitlab-empty-payloads
• fixing-issue-when-multiple-attachment-deletion
• fixing-list-of-users
• fixing-memory-leak-on-export-related-to-timeline
• fixing-mentions-for-users-with-capitalized-usernames
• fixing-ordering-on-archived
• fixing-signals-disconnection
• fixing-situations-where-project-owner-is-none
• fixing-svg-processor
• fixing-timeline-permissions
• fixing-travis
• fixing-upvote-downvote-api
• ft/4.2rc
• ft/events-refactoring
• ft/mdrender-cache
• ft/python38
• full-index-for-searches
• generate-api-doc
• generating-application-token-only-when-it-doesn't-exist
• generating-blocked-projects-on-sample-data
• github-auth-2
• github-import
• gitlab-comments-sync
• gogs-new-signature
• hectorfernandez/prevent-csv-injection
• hiding-email
• historic-refactor
• hooks-refactor
• hotfix/put_request_errors_partial_update_perms
• import-api
• import-api-in-synchronous-mode-returns-project-info
• import-delete-project-fix
• import-project-without-slug
• improve-feedback-when-registering-users
• improve-markdown-rendering
• improve-project-admin
• improve_importer_logs
• improvement/add_tags_to_csv_reoprts
• improvement/github_hooks_messages
• improvements-migrations
• improving-api-performance
• improving-cancel-account-api-endpoint
• improving-contacts-endpoint
• improving-csv-reports-performance
• improving-epics-progress
• improving-memory-usage-on-project-export
• improving-occ-for-not-bothering-when-not-necesary
• improving-performance-for-history-api
• improving-performance-when-updating-objects
• improving-project-stats-api
• improving-projects-api-performance
• increase-default-order-values
• integrity-error-duplicate-email
• invitations
• issue-2605-is-archived-bug-in-templates
• issue-2731-using-utf8-chars-in-wiki-titles
• issue-2818-when-I-coment-a-story-a-should-be-involved-by-it
• issue-2916-when-leaving-a-project-I-lose-all-my-watched-stuff
• issue-2991-when-a-new-comment-is-added-the-update-of-watchers-list-applies-in-the-next-future-change
• issue-3117-after-add-task-in-bulk-to-a-closed-us-it-is-not-reopened
• issue-3282-error-500-when-deleting-project-from-admin
• issue-3468-export-import-project-break-attachments
• issue-3492-search-fails-when-using-quotation-marks
• issue-3905-usernames-with-dashes-in-them-cant-be-@mentioned
• issue-3950-fixing-burndown-points
• issue-4530-some-issues-without-results
• issue-5017/import-from-jira
• issue-fix-user-story-neighbors-in-taskboard
• issue/1183-anonymous-users-api-get-error-500
• issue/1196-duplication-problem-with-partial-updates
• issue/1447/remove-us-with-role-points
• issue/1500/wiki-html-escape
• issue/1532/markdown-problems
• issue/1630/thead-tbody-on-markdown
• issue/1734/change_pasword_github_users
• issue/1870/error_in_by_ref_url
• issue/1886/500_api_filter_by_project_slug
• issue/1924/allow-multiple-message-action-on-commits
• issue/2072/fix_role_points_update
• issue/2098-search_error
• issue/2332/add-toc-extension-to-markdown-render
• issue/2457/patch_blocked_data_in_history
• issue/2518/wiki-toc-links
• issue/2572/on-status-open-closed-change-recalc-closed-user-stories
• issue/2584/global-search-with-partial-words
• issue/2592/default-status-on-tasks-and-issues
• issue/2614/change_us_points_from_15_to_13
• issue/2642/email-templates
• issue/2644/Windows-lotus-mails
• issue/2646/import_is_broken
• issue/2650/allow-local-networks-ips-in-gitlab-and-bitbucket
• issue/2785/fix-user-mentions
• issue/2803/slow-search-results
• issue/2839-timeline_delete_comment
• issue/2851/closed_milestones_errors
• issue/2851/closed_sprints_problems
• issue/2884/crop-images-for-timeline
• issue/2943/on-project-change-regenerate-refs-for-task-issues-uss
• issue/2959/fix-user-profile-links-in-timeline
• issue/2966/mileston-text-on-emails
• issue/2981/bitbucket-webhooks-fix
• issue/2995/add-custom-video-conference
• issue/3019/duplicate-entries-in-profile-timelines
• issue/3125/searchs-api
• issue/3299/errors_in_bitbuket_hook_calls
• issue/3299/errors_in_bitbuket_hook_calls_v2
• issue/3321/emoji_extension_uses_wrong_path
• issue/3372/velocity-not-calculated-properly
• issue/3427/some-searchs-are-failing
• issue/3755/including_permalinks_in_webhooks
• issue/3846/exclude_invisible_projects_in_discover_section
• issue/3856/show_if_i_am_a_meber
• issue/3886/multiple_unassigned_in_filter_lists
• issue/3995/remove_safe_filter_in_emails
• issue/4032/change_privacity_validation_error
• issue/4058/remove_memberships_of_cancelled_accounts
• issue/4059/clean_users_role_permissions
• issue/4061/invalid_error_when_add_memberships
• issue/4094/sprin
• issue/4114/remove_incomplete_project_if_import_fail
• issue/4217/improving-mail-design
• issue/4257/Mutiple_configured_webhhoks_trigger_on_the_same_url
• issue/4258/use_pep_263
• issue/4633/sort_attributes_in_project
• issue/4652/lost-tasks-on-sprint-view
• issue/4679/comment-permission-isnt-working-for-external-users
• issue/4756/dont-change-email-without-validation
• issue/4768/Notify-when-something-is-unassigned
• issue/4795/notification_even_they_are_disabled
• issue/4822/error-in-US-estimations-when-created-from-Epics
• issue/4841-invitation-login-with-plugins
• issue/4910/validate_assigned_to
• issue/4931/tag-creation-caps-bug
• issue/4995-multiline-commits-in-webhooks
• issue/5137/imported-projects-notify-incorrect-users-in-some-cases
• issue/804/int_gitlab2taiga_add_issue_comment
• issue/fix-emails
• issue/issue/deleting-custom-fields
• issues/4056-and-4075
• libs/update-redis
• libs/upgrade
• license-preamble-improvements
• live-notifications
• logger
• logging-export-import-exceptions
• luyikei-avoid-none
• luyikei-missing-import-http404
• main
• making-total_points-and-total_sprints-nullable
• making-update_attr_in_bulk_for_ids-work-in-asynch-mode
• marking-as-safe-email-subjects
• master
• max-members-per-project
• max-projects-per-user
• mga/20250930/upgrade
• mga/20251006/remove-ecdsa
• mga/20251006/upgrade
• mga/20251007/upgrade
• mga/20251007/upgrade-bis
• migonzalvar/200609/1
• migonzalvar/200610/1
• migonzalvar/200610/3
• migonzalvar/200615/1
• migonzalvar/200615/2
• migonzalvar/200615/4
• migonzalvar/200617/1
• migonzalvar/200626/1
• migonzalvar/200701/1
• migonzalvar/201006/upgrade-requirements
• more-efficient-json-export-generation
• more-flake8-fixes
• moving-github-tests-to-contrib-repo
• new-pricing
• niwinz-patch-1
• normalize-attachment-filename
• notification-refactor
• notify-refactor
• order-refactor
• ordering-user-projects
• owner-must-be-a-valid-member-of-a-project
• permissions
• pivotal-importer-fixes
• points-value-unique
• profile-timeline-fix
• project-name-not-unique
• project-templates
• psd-and-svg-preview
• public-projects
• quickwins
• random-fixes
• redesign-for-taskboard-and-backlog-summaries
• redis-cache
• redo/github-login
• refactor-owner-admin
• refactor/2229-standardize-title-fields
• refactor/auth-modules
• refactor/bameda-style
• refactor/is_owner_to_is_admin
• refactor/notification-level-names
• refactor/project-slug-method
• refactor/project_api
• refactor/remove-obsolete-settings
• refactor/remove-projects-tags-call
• refactor/signals
• refactor/tests
• refactor/use_our_get_object_or_404_function
• refactor/user-profile-form
• refactoring-bulk-update-milestone-api-call
• refactoring-bulk-update-order-api-calls
• refactoring-filter-data-API
• refactoring-likes
• refactoring-notify-policies
• refactoring-project-export
• refactoring-searching-system
• refactoring-watchers-for-projects
• release-issues
• release/3.1.1
• remove-api-html-renderer
• remove-deprecation-warning
• remove-descriptions-from-listin-API
• remove-fk-from-history
• remove-secret-key-on-applications
• remove-storage-path-call
• remove-users-table-full-scan
• removed-rest-framework-deprecated-decorators
• removing-rest-framework-deprecated-code
• removing-thumbnails-on-attachment-delete
• requests-reduction-refactor
• revert-144-notification-refactor
• rich-text-custom-fields
• rolepoints-update-fixes
• roles-filter
• send-signal-on-user-registration
• sentry11172
• seralot/20251201/gh-213-add-archived-code-to-project
• seralot/20251205/gh-213-archived-endpoints-protection
• seralot/20260102/protect-endpoints-comments-us
• signalkraft-enhancement/usermodel
• sitemap
• sitemaps-changes
• sites-remove
• small-bugfixes
• small-fix-on-epic-freezer
• sorting-correctly-tasks-and-attachment
• stable
• stable-4.2.14
• stable-5.0.15
• stable-5.0.x
• status-and-default_status-can-be-None
• storage-experiments
• storage-refactor
• svg-thumbnail-generation
• svg-thumbnail-generation-by-content
• sync-calls-for-resend-and-test-in-webhooks
• tags
• taiga-6
• task/3538/add_tribe_git_field_to_user_stories
• taskqueues
• tests-flake8
• throttling
• timeline
• timeline-rebuilder-as-a-service
• transfer-project
• travis-updated
• tweaks
• ugly-hack-to-temporary-disable-tiff-thumbnails-generation
• update-dependencies
• update-last-login
• updating-doc
• updating-timelines-on-user-profile-info-changes
• upgrade-to-celery4
• upgrade/django-1.9
• upgrade/requirements
• upgrades/django-pgjson
• upgrades/django1.7.8
• url-fetcher-for-cairo-svg
• us/1009/pgarray-query-refactoring
• us/1233/expose-import-export
• us/1313/throttling
• us/1368/humans.txt
• us/1380/sentry
• us/1396/extra-text-for-inviting-users
• us/1475/internationalization
• us/1517/attachment-delete
• us/1563/epics
• us/1616/slack-integration
• us/1637/gitlab
• us/1678/webhooks
• us/1680/email-redesign
• us/1785/gogs-integration
• us/1913/csv-reports
• us/2117/fa_proj/2122/upvote_content
• us/2119/get-in-touch-with-the-project-admins
• us/2126/task/2999/system-stats-resource
• us/2127/discover
• us/2911/mixin_users_with_memberships_in_project_detail_serializer
• us/320/task/573/backlog_total_uss_counter
• us/3903/show-sprint-in-search-results
• us/4186-2929/add_and_edit_comment_permission
• us/4186/add_can_comment_permission
• us/4259/improve_tagging_system
• us/4302/improve_tagging_system_v2
• us/4445/add-milestones-to-project-detail
• us/4640/mailchimp-to-sendinblue
• us/4662/duplicate-project
• us/55/custom-fields
• us/632/task/638/gitlab_from_edit_issue
• us/632/task/697/open_close_issues_from_gitlab
• us/632/task/762/change_status_on_delete
• us/646/task/819/bulk_update_kanban_order_with_swimlanes
• us/652/team-members
• us/675/convert-issue-to-us
• us/90/github-integration
• us/90/github-integration-issues_event_hook
• us/954-feedback
• use-psd-tools-for-psd-resize
• user-resources-dead-code
• user-stats
• users-trottling
• uuid-for-analytics
• v3.1.1
• watchers-validation-bug
• weblate-taiga-taiga-back
• wip-slow-test-1
• wrong-usage-of-static-resolution

Build # 892

Build Type

push

travis-ci

Committed by ikame

Commit Message

Check permissions when accessing attachments

Attachment files dispatching is now done through `RawAttachmentView`
view that checks for appropiate permissions.

When using the development server this view just redirects to the real
media path of the file.

When using the production server the special redirection header
`X-Accel-Redirect` is used instead to improve efficiency by instructing
the server to dispatch the file instead of django, but you also need the
following configuration (Nginx):

location /attachment-files {
    internal;
    alias /path/to/taiga/media/attachment-files;
}

It's recommended to also restrict the direct access from outside to the
`attachment-files` directory by using some configuration like this:

location /media/attachment-files {
    deny all;
}

Run Details

3784 of 4883 relevant lines covered (77.49%)

0.77 hits per line