Authenticated server user can see all other users' snapshots via web interface

Support
1

Hello, first of all thank you for Kopia. I find it an interesting project and quite useful.
I’ve noticed a problem: I’ve created a repository and, then, started a Kopia server to connect to that repository. I have some clients (each with different user/password) as I want to use a single repository for deduplication purposes. If I type “kopia snapshot ls --all” from a single client I can only see its snapshots, and it’s ok. But if I connect via web browser to https://xxxx:51515 and fill in any username and password set in the password file, I can see all the snapshots of all the clients. I find it quite unsafe…

Second, it would be great to have a “one file system” option, like the “x” switch of rsync.

Thank you.

2

Would you mind filing a bug on GitHub on the password issue, we should fix in the next release as we introduce ACL model for user accounts.

As for the “one file system”, it’s already supported via policies which you can attach to directories or globally:

kopia policy set --global --one-file-system true
kopia policy set <path> --one-file-system true

3

Thank you for your reply. Github issue filled. I didn’t notice the policy option - that’s great.