Potential Security Hole: Trusting Client for upload location about django-s3direct HOT 5 CLOSED

I normally dedicate an entire bucket for user uploads. However you can lock down a specific folder rather than leaving the entire bucket open.

from django-s3direct.

OK that makes sense. Security can be implemented on the s3 side of things. Thank you.

In my specific case I am using django-storages in addition to this one. Setting up both libraries to use different buckets/keys seemed like a hassle. I ended up modifying the policy_object under the create_upload_data function to force all user uploads into my bucket's media folder like this...

["starts-with", "$key", "media/"],  

Trying to upload to any other folder causes s3 to reject the request.

from django-s3direct.

Just to let you know that In the latest release this is no longer a problem as paths are predefined in settings.

from django-s3direct.

Thank you - Yes I see the changes!

from django-s3direct.

However, if someone uploads a file for their profile picture and all the user content is in one folder, what is stopping someone from uploading a file named the same thing and overwriting it? It would be nice to define the key dynamically at upload based on the incoming request

from django-s3direct.