Unauthorized Access to Non-Shared File via Copied Link

[tuzumkuru]

I encountered an issue with Seafile Community Edition and OnlyOffice integration where non-shared files can be accessed without authentication through a copied file link.

Steps to Reproduce

1. Set up Seafile Community Edition with OnlyOffice integration using Docker.
2. Create a document (e.g., Test.docx) in Seafile.
3. Click on the document to open it in the OnlyOffice editor.
4. Copy the file link from the browser.
5. Paste the link into a non-authorized browser or incognito mode.

Expected Behavior

• The link should prompt for authentication or display an error message if the user is unauthorized.

Actual Behavior

• The file opens in the OnlyOffice editor, displaying the content. The Seafile user appears connected to the document, even in an unauthorized session.

Additional Information

• The file is not shared, and no public link has been generated.
• Seafile is running on a Raspberry Pi using Docker with Cloudflare tunnels for HTTPS and internet access.

Configuration Details

• Docker Compose file and additional settings can be provided if needed.
• Relevant logs from Seafile and OnlyOffice are available upon request.

This behavior seems to bypass authentication for files that are not explicitly shared, which might indicate a misconfiguration or a security issue. Any guidance would be appreciated.

[imwhatiam]

@tuzumkuru Hello, we were unable to reproduce this issue locally. Could we log in to your Seafile web interface and linux server side to conduct debugging and troubleshooting?

[freeplant]

I think it is maybe caused by cache of Cloudflare.

[tuzumkuru]

Thanks for the replies.

I think it is maybe caused by cache of Cloudflare.

@freeplant Good catch. I tested it by setting a page rule that bypasses caching, and it correctly asked for login as expected.

@tuzumkuru Hello, we were unable to reproduce this issue locally. Could we log in to your Seafile web interface and Linux server side to conduct debugging and troubleshooting?

@imwhatiam The issue has been identified as Cloudflare's caching of the file link. If access to my setup is still required, I can provide it tomorrow.

That said, I believe this is still a concern. Why was the file cached while other pages requiring authentication were not? Even though the caching explains the behavior, it exposes a potential risk. Pages or files requiring authentication should never be cacheable, as this could lead to unauthorized access in scenarios similar to mine.