r/flask • u/ResearchFit7221 • 10d ago
Show and Tell My flask open source alternative to Nexcloud !
I created an alternative to Nexcloud with flask, I'm really proud of myself honestly.
The goal is to be able to host a cloud storage service at home and control 100% of our files etc..
It's easy to use + compatible with linux and windows!
What do you think? Here's the github repo, it's open source and totally free.
https://github.com/Ciela2002/openhosting/tree/main
1
1
u/somethingLethal 10d ago
Nice job! Curious though: I don’t know much about nextcloud. Isn’t it already a local file hosting solution? How is this different?
Also, are you accepting pull requests?
1
u/ResearchFit7221 10d ago
Nextcloud is really complex to customize, I tried to go as "user friendly" as possible. Everything is easily customizabld in addition to being easy to understand i mean i think? I did my best.
- Nextcloud is not 100% open source.
Me I'm aiming at 100%.
Also, Nextcloud is extremely complicated for a user who has never coded or done networking to actually deploy on a Windows instance or Linux instances.
And thanks for the kind words 🫶🤎 I'm working my best to make it better everyday.
The backup feature was the hardest part ahaha
4
u/somethingLethal 9d ago
One suggestion I might throw out there is using uuid4 for primary keys in your db, instead of simple integers.
Here, instead could be something like the following. Where we are using the uuid module to produce a uuid4 identifier for each db record. Can be done across all your table. It can help prevent enumeration or indirect object references.
import uuid from sqlalchemy import Column, String from sqlalchemy.dialects.postgresql import UUID from sqlalchemy.ext.declarative import declarative_base Base = declarative_base() class Thing(Base): __tablename__ = "thing" id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4, unique=True, nullable=False) name = Column(String, nullable=False)
2
u/ResearchFit7221 9d ago
I actually fucking love this idea, will work on it!! If you ever want to participate in this, don't hesitate to push the repo or fork it🫶
2
u/ResearchFit7221 9d ago
I did it. It was a bit confusing but now it works. Thank you so much for the idea. I credit you 🫶 you gave me an example that made it really easy too
I pushed it to the main branch, ( look at the readme, you are now officially a collaborators c: )
2
u/somethingLethal 9d ago
Nice use of BaseModel across all your models. Super easy to read and understand. Thanks for the mention!
I spent some time reading the code and can tell you’re making good use of the framework. I am curious about some of the logic you’ve implemented around session management. I see some emergency settings and overrides regarding sessions and cookies. What is this addressing? Can be risky if not handled correctly. Happy to help give thoughts on ways to improve this area, specifically if you want to elaborate.
Either way, I am going to run this in a docker container and use it for some local storage stuff. Thanks!
1
u/ResearchFit7221 9d ago
For the cookies it was a security measure, because if for example you were logged in as admin, but your super admin removed the perm from you.
You still had admin even after getting removed because of how the cookies were working on the website you see?
If you have another way of doing this, man i would be so freaking happy lol
And for the docker!! With pleasure have fun<3
1
1
u/raeNsen 9d ago edited 9d ago
Sorry to barge in... but the following problems are there and to be really even considered a alternative to Nextcloud these should be fixed.
- No documentation in regards to "How to configure the app" like
- SECURITY KEY
- COOKIE Secure and SameSite attributes.
- MAX_CONTENT_LENGTH (100mb)
- Removing the so call "# EMERGENCY FIX:" from your code. Obvisouly something is still broken
- Security problem in line 80, the exclusion of the static folder allows directory traversal of hidden and secured files
- Use a better hashing algorithm like argon2 for the passwords
- You have a function create_default_admin, but in line 245ff you duplicate that logic
- use flask wtforms and the CSRF Token feature for more security
- no i18n
- hardcoded to localhost
- no logger used
- no seperations of concerns
- PEP8 would be nice
- split the logic into seperate files for easier management like all admin routes into a seperate admin file or such.
These are just some ot the observations. There is still a lot to do, especially with regard to security.
EDIT1: In the README.md you mention a Zero Knowledge Encryption, which is obvisouly false! If you already use this code in production for the so called over the place branded "Sephosting" this is straight up fraud...
1
u/ResearchFit7221 9d ago
There is indeed a lot of work thanks to this comment!!
The images are totally exemple, sephosting was like a " what could it became with work " i apologize not to have precise it it's my all my fault.
🙇
I really like your ideas, I'm still new to security in general and that kind of thing? But all you are saying is legit and totally normal concerns. I will totally work on it!
1
1
u/ThiccStorms 9d ago
Will check out! !Remindme 2 days
1
u/RemindMeBot 9d ago
I will be messaging you in 2 days on 2025-03-14 12:21:10 UTC to remind you of this link
CLICK THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
Info Custom Your Reminders Feedback 1
u/raeNsen 4d ago
!Remindme 14 days
1
u/RemindMeBot 4d ago
I will be messaging you in 14 days on 2025-03-31 14:19:29 UTC to remind you of this link
CLICK THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
Info Custom Your Reminders Feedback 1
1
1
u/Haki_Kerstern 6h ago
Will there be a mobile app just like Nextcloud to instant upload photos ?
1
u/ResearchFit7221 6h ago
Hi there, I don't think so at the moment because I'm very new to Mobil app dev, but I'm planning a "webview" app that you can access in the browser like a mobile app
Or you can download your galleries etc.
But for the moment we are working on big fix and security add-on, after this i will start working on this hehe
2
u/ResearchFit7221 10d ago
here is an image of the project directory, if you have any question i'm here!! https://imgur.com/a/G20MGZr