Hi, I also posted underlaying issue in the Github Issue. But maybe somebody this is also interesting for other users
Hi, first of all my compliments to DroneDB Registry. Im just getting started with the application / API and it looks very promising. When working with the share / API function one issue “caught” my eye. Since I can also duplicate this one hub.dronedb.app I’m using this as an example.
- I created a private dataset on hub.dronedb.app
- In this private dataset I created 4 subfolders (which contents should be private as well, right?)
- In subfolder 1 I uploaded an image.
- I made a share link from the image from subfolder 1 I would like to share to a friend: https://hub.dronedb.app/orgs/aeret/ds/private_set_1/download/very_private1/flower.jpeg?inline=1
- Because I now know the name of the hidden dataset private_set_1 I can request all the subfolders in this dataset via the /list command
https://hub.dronedb.app/orgs/aeret/ds/private_set_1/list
- which gives me 4 subfolders
very_private1
very_private2
very_private3
very_private4
- with the /list?path= command I can see the files in each private subfolder, for example:
https://hub.dronedb.app/orgs/aeret/ds/private_set_1/list?path=very_private4 - This gives me the content of this folder, such as “path”:“very_private4/very_secret_picture.jpg”
- It’s possible to download this file also with a small change in the url from step 4
https://hub.dronedb.app/orgs/aeret/ds/private_set_1/download/very_private4/very_secret_picture.jp(g)
(Replaced jp(g) with jpg to prevent auto load jpg in the topic).
Summary
When I try to acces the API via https://hub.dronedb.app/orgs/aeret/ it gives me a warning when a user is not logged in.
When I know the name of a (private) folder I can acces the contents without logging in (step 5 to 9)
https://hub.dronedb.app/orgs/aeret/ds/private_set_1/list
small edit:
The reason I’m posting this issue is that on my own DroneDB Registry installation I have a private dataset with 50 subfolders (11000 images and 100GB). I don’t like the idea that when sharing one image from this private set, one can see / view all the contects of these subfolders via the above workflow.