I'm trying to somehow allow other people to download uploaded files on QuickBase on a different website. I have files on QuickBase uploaded, but people need to sign-in to QuickBase to download it. Is there any other way around it?
You can grant what is essentially anonymous access to one of your Quickbase applications by giving "Everyone on the Internet" a role in your application. It gives anyone with a link to that application whatever access level is defined in the role given. If you want to only share files, you could create a role that has view only access of that specific file attachment field and assign that to "Everyone on the Internet". If you want to be selective about which records are available for download you can include a checkbox to "Make Public" and include that in the role's view logic.
You grant "Everyone on the Internet" access in the add user form for the application. If you start typing "Everyone on the Internet", you'll see it pop up as a recommended user name. If you do not see this as an option, that means that granting open access was disabled by one of your billing account administrators.
Just remember, whatever permissions you grant "Everyone on the Internet" applies to literally anyone on the Internet that has a link to your app. Of course, you can always use a separate file hosting service like Dropbox or Box if you want to avoid the Quickbase issue entirely.
You can allow file downloads for anyone with the link to the file. That's a setting for every file attachment field on QuickBase. Once you go to the specific attachment field setting you will find it under File Attachment field options. It's a checkbox called "Allow access to this file attachment from a Quickbase link without signing in". For me, that's prefered compared to giving everyone access to the app and restricting all the other fields by role.
Related
I have an internal app (not a published one, only used within our Google Workspace domain) which is a command line tool to update the contents of some Google Sheets. It currently uses the https://www.googleapis.com/auth/drive scope and works fine.
I want to minimize the privileges of the authorization token that this app caches, and by reading the documentation it seems that I should be able to use the https://www.googleapis.com/auth/drive.readonly scope to find the file I want, and also https://www.googleapis.com/auth/drive.file to grant write access to only a specific file.
With the reduced scopes, I am not surprised to get an error like:
appNotAuthorizedToFile: The user has not granted the app 566375348811 write access to the file 1UsItGhBHwRaodHbv5g1LCrSESUZBkskDvKDkbGjREjI
The only relevant documentation talks about integrating apps with Google Drive and using the Drive Picker UI which I expect does this authorization behind the scenes. Since this is an internal command line tool, I really don't want to go that route.
Hence the question:
How do I open a file in a command line application using the https://www.googleapis.com/auth/drive.file scope?
I'm OK even if I need to set some magic metadata on the file to make it accessible.
Update
As I got a couple of responses saying that when using drive.file it is not possible to access files which are not created by the application, I am putting some supporting documentation here to show why I think it is possible:
The API-specific auth info is the first document on the Google Drive API page, and it specifically mentions:
So, when possible, use non-sensitive scopes as they narrow access to
specific functionality needed by an app. In most cases, providing
narrow access means using the
https://www.googleapis.com/auth/drive.file per-file access scope.
Further down the page it mentions:
This scope enables users to select the specific files from Google
Drive, and through the Google Picker, that they want to allow your app
to access.
I understand this to mean that it is possible to open files which were not created by the app, even when using drive.file.
My problem is that the document goes on to explain:
Many apps work with per-file access without any changes. If you are
currently using your own file picker, we recommend switching to the
Google Picker which fully supports the drive.file scope.
Well, since I am using a command line app, I cannot use the Google Picker, so I am asking how to implement my own. I do understand that the picker itself needs to have access to all the files (hence the need for a drive.readonly scope), but to actually be able to write the files, it needs the elevated permission of drive or the more restrictive per-file access of drive.file.
If I simulate an authorization request for drive.file I get a prompt which explains that authorizing the request will grant my app to:
See, edit, create, and delete only the specific Google Drive files you use with this app ℹ️
Clicking on the information icon I get a more verbose explanation which reads like it support opening any file I authorize:
This app wants permission to create new files or change existing files
that you open with this app. Once authorized, the app can:
See these files
Upload and download these files
Delete these files
See the names and emails of people you share these files with
Share and stop sharing these files with others
Organize these files
There may be private information in your Google Drive, like financial
records, medical reports, photos or tax info.
There are also other examples of applications like ZIP Extractor or diagrams.net or Photo Editor which use the drive.file scope (based on the authorization prompt), and which I can use to open and edit files that were not created by them.
I am posting this as an answer, to demonstrate an ugly "workaround" for the issue.
TL;DR: Use a web based frontend to authorize access to files. Once the app is authorized, the command line app inherits the permissions.
More step by step instructions, assuming we already have a working command line project:
Go to https://myaccount.google.com/permissions and revoke all access I have granted to my app.
Follow the instructions at the Drive Picker API to update my current GCP project.
Create an API key. OK to be unrestricted, but I restricted it to https://localhost:9843
Create a new OAuth 2.0 client ID of a "Web application" type (my current one is "Desktop" type and that would not work). Authorize https://localhost:9843 as a JavaScript origin.
Copy the helloworld.html example at the bottom of the Drive Picker API guide which is also on GitHub with the following modifications:
Set developerKey to the API key created above
Set clientId to the new OAuth 2.0 client ID created abovce
Set appId to the numeric project ID of my GCP project
Add 'include_granted_scopes': true to the call to window.gapi.auth.authorize
Update createPicker to make it easier to find the files I want. E.g., set the mime type filter to application/vnd.google-apps.spreadsheet.
Host the example in a browser with ruby -rwebrick/https -e 'WEBrick::HTTPServer.new(:Port => 9843, :DocumentRoot => ".", :SSLEnable => true, :SSLCertName => "CN=localhost", :SSLCertComment => "Autogenerated" ).start'
Now, if my command line app fails to edit a file, I can use https://localhost:9843/helloworld.html to grant access to the file, and my command line app can then edit that file.
If you check the docs for the scope you will find it says.
https://www.googleapis.com/auth/drive.file View and manage Google Drive files and folders that you have opened or created with this app
This gives your app access to files that the app itself created or has previously opened.
You should also know that there is no way to limit authorization to a single file. Authorization is all or not thing.
How do I open a file in a command line application using the https://www.googleapis.com/auth/drive.file scope?
You make sure that the file was created by the app itself. using files.create. If the file was created by any other app the you cant access it using the drive.file scope
There is one note though if you have https://www.googleapis.com/auth/drive.read-only scope and you open that file to read it. the line where it says opened or created with this app implies to me that once you have opended it for read in this app that you would then be able to use it with https://www.googleapis.com/auth/drive.file but its not something I have tried.
Another thing is im not sure what you mean by open the google drive api is a file storage api its not going to let you see the contents of the file your going to have to download it and open it locally. Have you considered going though the Google sheets api if you want to read and write to it programmatically?
Sue has a standard user account domain account on Windows 10 Pro. She has an application that can run from the command line or as a service. The service runs with her credentials. Using the SC command the service has been assigned an unrestricted sid (SERVICE_SID_TYPE: UNRESTRICTED). The service name is NT SERVICE\MyService. I want to allow Sue full control of a file when running the program from the command line. I want the service to have Read Attributes and Read Extended Attributes access only.
Using the service account I adjusted the security settings on the file by denying the service all access except for Read Attributes and Read Extended Attributes. I added a second entry that gave it Read Attributes and Read Extended Attributes permission. I've confirmed these are the settings by viewing the Effective Access settings in the Advanced Security Settings dialog box: all of the rows in the Effective Access column contain Xs except for Read Attributes and Read Extended Attributes. They have checkboxes. The rows with Xs have "File Permissions" as their "Access limited by" column.
Still the service is able to change the files permissions. I'm not sure what I'm doing wrong and would appreciate any pointers. I'm open to other approaches to achieving the results I'm after.
The per-service SID was working properly. After reviewing Harry's comments and checking the containing folder permissions I got things working. Thanks a lot Harry.
I'm using the enterprise library and AZ Man to authenticate users into my winforms application. I've got the code working fine using the XML file. I don't understand how to securely deploy the application though.
In app.config there is a path to the XML file. There doesn't appear to be anything stopping a user from opening this XML file in azman.msc and giving themselves access they shouldn't have.
If we put the XML file on the server and make it read-only to user, there is nothing stopping the user from copying everything locally and changing the app.config pointer to a local file they can write to.
There seems to be something major I'm missing here, but I've been reading and can't figure it out.
I think what you'd probably want to do is create your authorization store inside of Active Directory instead of an xml file. You can find instructions on how to do that here. Here's the interesting bit:
Working with Authorization Stores
Creating an Authorization Store
Open Authorization Manager, right-click Authorization Manager, click
Options, select Developer mode, and then click OK.
In the
Authorization Manager console, right-click Authorization Manager,
click New, and then click Authorization Store.
Select either Active
Directory or XML file as the store type.
Type a complete store name in
the Store name box, or use the Locations button to select a location
by using the New Authorization Store dialog box.
If it is an Active
Directory authorization store, use the LDAP name -- for example
CN=myStore,CN=Program Data,OU=Authorization,DN=myCompany,DN=com. If it
is an XML authorization store, use a path and file name that will be
valid at run time -- for example C:\AuthStores\MyStore.xml.
Type a
description of the new authorization store in the Description box, and
then click OK.
NOTE: Authorization stores can be created only in Developer mode. See
the "Setting the Authorization Manager Options" section of this
article for instructions about setting Developer mode.
Once you have the store created in Active Directory you can restrict who has write access to AD and the AzMan store. You can also create a store in SQL if you so desired.
Another option you have is to encrypt your connection strings to AzMan in your app.config. And since you're using Enterprise Library, I think you have the option of encrypting the entire AzMan xml file. None of it is completely bulletproof, but your users would have to go through a lot of trouble to hack your application. But if your users are willing to go through that much effort to break into your program, you don't have a programming issue - you have a personnel issue that needs to be addressed (my opinion, anyway).
This looks like a good walkthrough on encrypting app.config sections. Essentially, I think the idea is you create a new RSA key on your workstation and use that key to encrypt the app.config sections. Then import that key to a server and grant your users read access to that key. I'm sure there are plenty of other solutions for encryption if you Google it (or search here on stackoverflow).
does anyone know of a simple module or extension etc for Joomla that would enable the admin to upload a file relevant to a specific user login?
For example, they have a bunch of user accounts, and would like a registered area on the website that would show files relevant to only that user credentials.
In the backend, they would easily like to add a document and select which user can see it.
You might want to check out the "Component Access Permission" extension, here
I have a query regarding accessing Skydrive folders programmatically through the Live SDK on Windows Phone.
So the scenario I have at hand is that a Windows phone app that I have built creates folders (and files) on your Skydrive. Now I want the following functionality which I haven’t been able to do so till now.
Is it possible that I can programmatically share my folder and files with View (and/or edit) permissions to my friends (as I know their user ID)?
If I am able to share such a folder can I access the content after logging in (with my live ID) from my phone. By accessing I mean download or stream content.
If in step 1, a person to whom the file is shared is provided edit permissions how can I programmatically edit such a file? The current problem I am facing in this step is that to update a shared folder the live sdk requests a wl.contacts_skydrive_update scope, but while logging in I am notified that no such scope exists.
This is the Error message I get when I try to get a shared_edit_link:
request_token_unauthorized: Microsoft.Live.LiveConnectException: The
provided access token does not have access to this resource. An access
token with one of the following scopes is required:
'wl.contacts_skydrive_update'.
Although the user does have edit permissions. Note: Such a scope doesn't exist.
There is a thread on this where it was listed as a bug in the beta. They said that now it should be fixed and you should only need this scope: 'wl.contacts_skydrive'.
here is the thread