feat: warning about folders public links #178
Conversation
rodcoffani
commented
Mar 14, 2025
rodcoffani
commented
- warning (text or modal) triggered when creating an Editor link for a folder
- add a maxDate property on oc-datepicker component
- set default expiration dates for Editor links on folders
- only for folders with RW permissions - modal if the link is RW when creating - div if the permission was updated after
- default expiration date for folders with RW permissions is 30 days - if the expiration date is set for more than 3 years, is updated - removes the option to unset expiration dates for RW folders
| warningMessage.className = 'oc-mb-m oc-p-s oc-background-secondary oc-rounded' | ||
| warningMessage.id = 'files-file-link-warning' | ||
| warningMessage.innerHTML = $gettext( | ||
| 'Anonymously writable folders might be abused to store illicit material. <span class="oc-text-bold">Therefore, the default expiration time has been set to one month.</span> Please consider sharing to specific users or groups if the intended audience has a CERN (primary or external) account.' |
There was a problem hiding this comment.
This is ok, but we should push this upstream, so I would try to improve a little bit more.
That means that the message needs to be configurable (and not hard copied in two different places), in config.json. I would take that as the condition to show the warning message (if config is set, then we show it when adding a folder with editing rights. Otherwise we don't show anything). The message should take into consideration the current used language (check other examples in wich we set different messages depending on the language).
| if (unref(resource).isFolder && options.type === 'edit' && !linkShare.expirationDateTime) { | ||
| Object.assign(options, { | ||
| ...options, | ||
| expirationDateTime: DateTime.now().plus({ days: 30 }).endOf('day').toISO() |
There was a problem hiding this comment.
Please make these things configurable as well (I mean the default and maximum). I would expect to have this in the same place where oC enforces the use of passwords for public links, for example. I'm not sure this comes from config.json, it might be a "capability" (meaning that this is set in the backend and enforced there as well).
