If a link is generated that allows anybody to click on it and then view the file, then that completely bypasses the "restricted" feature altogther. If I RESTRICT a file to specific users, then only those specific users should be able to access the file after they have logged in. That said – if you think we misunderstood your report, and you see a well-defined security risk, please provide a detailedĪttack scenario where you demonstrate how this issue could be exploited to attack other users or Google. Hi! Although it may come as a surprise, this is actually working as intended. The employees email is hijacked and the hacker with the link can now view the document even though they have not logged in. I set a senesitive/private document to RESTRICTED and share with an employee.
Anybody with the link can now view the document without logging in, even though it is set to RESTRICTED. In the email it says "This email grants access to this item without logging in. :max_bytes(150000):strip_icc()/001-send-files-up-to-10-gb-with-gmail-using-google-drive-1171891-87c905b61f8944e38cb300924d4a954d.jpg "how to share google drive files with others")
User receives an email that Document was shared with them.
Under sharing, set the file to RESTRICTED. Summary: Sharing a Restricted file sends email to added user with link accessible by anyone Note Google's response that this is apparently working as intended. If the Public Link option and the Restricted option both give anybody access to the file, then what is the difference? Per issue tracker, Google seems to think this is okay.Īm I missing something here, or misunderstanding how this is supposed to work?ĮDIT: I have more details on the issue and it is better described as this: Restricted files that have been shared with a non-Google email incorrectly still show their status as Restricted, when in reality they are accessible by Anyone with the link.ĮDIT: The tracker link is not accessible to everybody, so I am reproducing the thread here. However, Google seems to think that anybody with the link should be able to access the file, whether they are logged in or not. So it seems to me that when I share a Google Drive file using the Restricted option, that only the person I shared it with should be able to access it.
0 kommentar(er)
