Re: [GMG-Devel] May I set content as private in a mediagoblin instance?

[ayleph]

On 12/26/2017 05:56 AM, Jorge Arévalo wrote:
> Hello devs,
>
> I've been looking for services to store my family photos&videos, keeping 
> the ownership of my data, and I came across mediagoblin. As a Libre 
> Software advocate and programmer, I love the idea.
>
> So, I deployed my own mediagoblin instance, and now I'm trying to change 
> privacy settings. I see all content is public by default, but I do not 
> want my family pics & videos to be public. The thing is I can't find an 
> obvious way to make them private, and I'd like to provide this service 
> to other members of my family with poor computer skills. They can easily 
> share pictures and videos with flickt or youtube. I want them to do it 
> with mediagoblin too.
>
> I've been looking for privacy settings options in documentation but 
> can't find them. So, is it possible to make pics & videos private? A 
> config setting I'm missing?
>
> Thanks people!

Hi Jorge,

Thanks for your interest in MediaGoblin. You're not missing a 
configuration setting; there is no setting to make media private. This 
is a feature that has been requested by many people but hasn't been 
implemented in MediaGoblin itself yet. But I can offer you a couple of 
options to restrict access to your site if you're able to do some of the 
work yourself.

If you're using a web server to provide a reverse proxy or fcgi/wsgi 
connection to your MediaGoblin instance, then you can configure 
authentication in your webserver with an htpasswd file. Please refer to 
your webserver's documentation for how to configure this.

Another option is that you could try to modify the MediaGoblin code 
itself to lock down the root view and the media views. This won't 
prevent someone from sharing the direct link to a file, but it prevents 
other people from browsing the site. To require someone to be logged in 
to see a "view," you can add the @require_active_login decorator to that 
view's function definition. For example, if you look at the 
default_root_view function in 'mediagoblin/views.py', you'll see that it 
already has the @user_not_banned and @uses_pagination decorators. You 
could probably add @require_active_login to prevent people from seeing 
the root view when not logged in. You would also need to add this to 
many of the view function definitions in 
'mediagoblin/user_pages/views.py', and maybe some of the other 
'views.py' files such as 'mediagoblin/listing/views.py' which contains 
the atom feed.

I hope this helps. Let us know if you need help trying to implement or 
test either of these ideas.

Thanks,

--
ayleph