1

in a wagtail project, I need all image and document file URLs to be "private", e.g. to respect the "privacy setting" of the collection that file/instance belongs to. Further, these URLs must be private even if the URL is known/guessable.

For wagtail documents, I've found:
https://docs.wagtail.io/en/stable/reference/settings.html?highlight=sendfile#documents
which works.

I've expected a similar setup/reference for wagtail images, but got:
https://docs.wagtail.io/en/stable/advanced_topics/images/image_serve_view.html#advanced-configuration

I did not manage to successfully implement this image_serve_view-sendfile-configuration.

Anyone knows a way to serve wagtail images the same way as wagtail documents (via the simple setting WAGTAILDOCS_SERVE_METHOD?

I'm OK with the StreamingResponse in case django-sendfile is not installed. I just want my wagtail documents AND images to respect the privacy level defined via the collections privacy setting (e.g. "Private, only accessible for logged-in users").

But even with a more elegant and performant solution via django-sendfile (or a more up-to-date and maintained fork like django-sendfile2) I'm missing documentation which details the steps to implement this setup for wagtail documents and wagtail images.

gasman
  • 23,691
  • 1
  • 38
  • 56
tombreit
  • 1,199
  • 8
  • 27

1 Answers1

0

Enforcing privacy for images is not as simple as documents for the reasons described in this issue:

https://github.com/wagtail/wagtail/issues/3880#issuecomment-332798643

That issue has been referenced more recently, so i believe is still the case. It is marked as 'someday' (valid but lower priority).

This is not a full answer, but hopefully helps articulate the problem.

autopoietic
  • 170
  • 1
  • 5
  • Thanks - the issues mentioned by @autopietic are a better description than the wording in my own question. Until the wagtail collection privacy settings for images and documents behave as the should be, I will implement this permission check via https://github.com/edoburu/django-private-storage (my use case is somewhat special, as I only need these settings for instances of media files added via a custom wagtail formbuilder). – tombreit Jun 05 '21 at 22:51