diff --git a/src/App.js b/src/App.js index 4989ff2..6b6dbe3 100644 --- a/src/App.js +++ b/src/App.js @@ -14,6 +14,8 @@ import ConfigAutomation from './Pages/Software/Projects/ConfigAutomation'; import KanjiApplication from './Pages/Software/Projects/KanjiApplication'; import SwivForPi from './Pages/Software/Projects/SwivForPi'; import WifiPrototype from './Pages/Software/Projects/WifiPrototype'; +import RaspberryJukebox from './Pages/Software/Projects/RaspberryJukebox'; +import AttachmentModule from './Pages/Software/Projects/AttachmentModule'; import Radio from './Pages/Radio/Radio'; import Components from './Pages/Radio/Components'; @@ -21,7 +23,6 @@ import Balkon from './Pages/Radio/Balkon'; import Linux from './Pages/Linux/Linux'; import Footer from './UI/Footer'; -import RaspberryJukebox from './Pages/Software/Projects/RaspberryJukebox'; @@ -40,6 +41,7 @@ function App() { }> }> }> + }> }> }> }> diff --git a/src/Pages/Software/Projects/AttachmentModule.js b/src/Pages/Software/Projects/AttachmentModule.js new file mode 100644 index 0000000..9173d54 --- /dev/null +++ b/src/Pages/Software/Projects/AttachmentModule.js @@ -0,0 +1,57 @@ +import React from 'react'; + +const AttachmentModule = () => { + return ( +
+
+ +
+ +
+
+

Attachment Module

+

Solving the problem of someone else

+

Sometimes a project owner wants a feature implemented in their project that the developers somehow are unable to realize. The project was a website containing a form that customers would enter text data on. The project owner asked for a feature which allowed customers to attach files to this form.

+

As a "temporary" solution, I suggested creating a stand-alone server that would handle file uploads that would be linked to the ID number of the form. This consisted of 2 servers. One server would be a simple web interface, the other a database server that hosted a simple API.

+

Both servers were VMs running RHEL.

+

The web server used the Nginx engine and the Django framework. Python handles the HTTP requests with Gunicorn, a WSGI gateway.

+

The database server used a MySQL server to host uploaded file data. To expose this data, Flask RESTful was used to serve a simple API.

+

This was the first separate project I created for the company, so I set up a GitLab server for version control.

+
+ +
+

Workflow

+
    +
  1. The website hosting the forms, would serve a hyperlink to the "attachment module", along with the form's ID.
    2. +
  2. The user is redirected to the website with a simple input field and browse button where a file can be uploaded.
    3. +
  3. The file is validated by type, size and upload time.
    4. +
  4. The file is copied to the database server.
    5. +
  5. The file is also cached for 2 weeks on the web server, for quicker access.
    6. +
  6. The database server creates a database entry.
    7. +
  7. A link to the file is created for access on the website.
    8. +
+

After a file is uploaded, someone else will want to access it.

+
    +
  1. The user accesses the website and clicks on the link with the file name.
    2. +
  2. If the file is cached on the web server, then this file is opened.
    3. +
  3. If the file is not cached, the web server downloads the file from the database server and then opens it.
    4. +
+
+ +
+

Lessons learnt

+

The project owner did not want the users to separately log in to the web server of the attachment module. So a big security issue is that anyone with the link, can access uploaded files. At the time this was agreed to be a temporary solution. The project was deployed in 2017 and in 2021 this project was still running though. After all, the business must go on and if the problem's symptoms seems fixed, why bother with it further...

+

Because other users could access other uploaded files using the right link, it was decided that users could only upload and never delete any files.

+

A big learning point for me was that not to compromise security, even for projects that are considered temporary. A problem never occurred. This compromise caused silly decisions to not allow users to delete their own files. I will defend my standpoint much more and use this project as an example.

+

The actual problem here though, is why the other developers were not able to create a safe file upload feature.

+
+
+
+ ) +} + +export default AttachmentModule; \ No newline at end of file diff --git a/src/Pages/Software/Software.js b/src/Pages/Software/Software.js index 550966e..ed34224 100644 --- a/src/Pages/Software/Software.js +++ b/src/Pages/Software/Software.js @@ -44,6 +44,7 @@ const Software = () => {
  • Embedded Game
  • Kanji flashcard Android application
  • Raspberry Pi Jukebox
    • +
  • Attachment Module