[xwiki-users] XE's Antivirus plugin for attached files
Hi XWiki Devs/Community, We're planning a deploy of XE on our Enterprise (a brazilian government agency) as the main intranet tool, for about 400 heavy users (in thesis, they'll generate a lot of content). We're sure that XE can handle it smoothly and it will bring a LOT of help on the day-to-day work of our office. We're doing some optimizations and fine tunning for the deploy in production. Meanwhile, we're facing some troubles with our workstations's antivirus tools, which brings me some concerns about the attachment files on the filesystems. Trying to address a potential problem (users using attached files to spread infected files to other users and, worst, other government agencies, which have also critical mission like ours), I would like to use the same approach we use on our other systems we've built at home: calling an AV engine (such as our cluster of ClamAV servers) from the webapp (we already use some java API for this, on our web apps) to scan every file being uploaded and before being attached to the wiki, and show some message to the user, in case of some trouble. I've searched for some plugin or initiative about this, but couldn't find any. Is there any going on? If not, from where can I start and what should I put under consideration, in order to guide our dev staff to plug it in xwiki's core as a plugin/extension? Forgive myself in advance if this information is located somewhere on the documentation and I couldn't find it. Best Regards, -- Ramon Gomes Brandão ** ** *RAMON GOMES BRANDÃO*
One solution is to write an event listener component (for save event for instance) that checks if an attachment is uploaded and scans it using your antivirus API. Unfortunately the documentation is a bit outdated http://extensions.xwiki.org/xwiki/bin/view/Extension/Observation+Module+Loca... . Maybe others have better suggestions. Hope this helps, Marius On Thu, Apr 11, 2013 at 12:21 AM, Ramon Gomes Brandão <ramon.brandao@planejamento.gov.br> wrote:
Hi XWiki Devs/Community,
We're planning a deploy of XE on our Enterprise (a brazilian government agency) as the main intranet tool, for about 400 heavy users (in thesis, they'll generate a lot of content). We're sure that XE can handle it smoothly and it will bring a LOT of help on the day-to-day work of our office.
We're doing some optimizations and fine tunning for the deploy in production. Meanwhile, we're facing some troubles with our workstations's antivirus tools, which brings me some concerns about the attachment files on the filesystems. Trying to address a potential problem (users using attached files to spread infected files to other users and, worst, other government agencies, which have also critical mission like ours), I would like to use the same approach we use on our other systems we've built at home: calling an AV engine (such as our cluster of ClamAV servers) from the webapp (we already use some java API for this, on our web apps) to scan every file being uploaded and before being attached to the wiki, and show some message to the user, in case of some trouble.
I've searched for some plugin or initiative about this, but couldn't find any. Is there any going on? If not, from where can I start and what should I put under consideration, in order to guide our dev staff to plug it in xwiki's core as a plugin/extension?
Forgive myself in advance if this information is located somewhere on the documentation and I couldn't find it.
Best Regards,
-- Ramon Gomes Brandão
**
**
*RAMON GOMES BRANDÃO*
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
Hi, I remember this exact plugin being written for a project I worked on something like 3 years ago. IIRC, the test was actually made before letting an user download a file: if the file was deemed dangerous by the antivirus, the user was presented with a message saying that they were not allowed to download the file and a mail message was sent to the administrator. Unfortunately I can't find the code on extensions, I'll try to see if I can still find it somewhere. Guillaume On Thu, Apr 11, 2013 at 9:52 AM, Marius Dumitru Florea < mariusdumitru.florea@xwiki.com> wrote:
One solution is to write an event listener component (for save event for instance) that checks if an attachment is uploaded and scans it using your antivirus API. Unfortunately the documentation is a bit outdated http://extensions.xwiki.org/xwiki/bin/view/Extension/Observation+Module+Loca... .
Maybe others have better suggestions.
Hope this helps, Marius
On Thu, Apr 11, 2013 at 12:21 AM, Ramon Gomes Brandão <ramon.brandao@planejamento.gov.br> wrote:
Hi XWiki Devs/Community,
We're planning a deploy of XE on our Enterprise (a brazilian government agency) as the main intranet tool, for about 400 heavy users (in thesis, they'll generate a lot of content). We're sure that XE can handle it smoothly and it will bring a LOT of help on the day-to-day work of our office.
We're doing some optimizations and fine tunning for the deploy in production. Meanwhile, we're facing some troubles with our workstations's antivirus tools, which brings me some concerns about the attachment files on the filesystems. Trying to address a potential problem (users using attached files to spread infected files to other users and, worst, other government agencies, which have also critical mission like ours), I would like to use the same approach we use on our other systems we've built at home: calling an AV engine (such as our cluster of ClamAV servers) from the webapp (we already use some java API for this, on our web apps) to scan every file being uploaded and before being attached to the wiki, and show some message to the user, in case of some trouble.
I've searched for some plugin or initiative about this, but couldn't find any. Is there any going on? If not, from where can I start and what should I put under consideration, in order to guide our dev staff to plug it in xwiki's core as a plugin/extension?
Forgive myself in advance if this information is located somewhere on the documentation and I couldn't find it.
Best Regards,
-- Ramon Gomes Brandão
**
**
*RAMON GOMES BRANDÃO*
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
Guillaume, this plugin is very interesting to me too. Tell us if you found, please. I'll try to develop one for Ramon's purpose . But I'm a beginner and need to study hard for it ... -- View this message in context: http://xwiki.475771.n2.nabble.com/XE-s-Antivirus-plugin-for-attached-files-t... Sent from the XWiki- Users mailing list archive at Nabble.com.
Well, in the end I wasn't able to find a working implementation of the plugin. I'm sure it existed at some point, but unfortunately it was never contributed properly. Sorry, Guillaume On Sat, May 11, 2013 at 1:11 AM, Evandro Nogueira Exposto < evandronexp@gmail.com> wrote:
Guillaume, this plugin is very interesting to me too. Tell us if you found, please. I'll try to develop one for Ramon's purpose . But I'm a beginner and need to study hard for it ...
-- View this message in context: http://xwiki.475771.n2.nabble.com/XE-s-Antivirus-plugin-for-attached-files-t... Sent from the XWiki- Users mailing list archive at Nabble.com. _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
participants (4)
-
Evandro Nogueira Exposto -
Guillaume Lerouge -
Marius Dumitru Florea -
Ramon Gomes Brandão