Permission System

Complete guide to copyparty’s permission flags and access control

Copyparty uses a flexible permission system with single-letter flags to control user access to volumes.

Permission Flags

Read Permissions

r · read

Full read access

• Browse folder contents
• Download individual files
• Download folders as zip/tar
• See filekeys and dirkeys
• View file metadata and properties

accs:
  r: *  # everyone can read

g · get

Get-only access (no browsing)

• Download files by direct URL only
• Cannot see folder contents
• Cannot download as zip/tar
• Useful for “hotlink” scenarios

accs:
  g: *  # anyone with the URL can download

Often combined with filekeys to prevent URL guessing.

G · upget

Upload-get access

Same as g but uploaders can see their own filekeys.

• Upload files
• Receive working direct link after upload
• Cannot see other users’ uploads
• Cannot browse folder

[/sharex]
  /mnt/screenshots
  accs:
    wG: *  # anonymous upload, get links back
  flags:
    fk: 4  # 4-character filekeys required

h · html

HTML-only access

Same as g except:

• Folders return their index.html file
• Filekeys not required for index.html
• Useful for static website hosting

accs:
  h: *  # serve static HTML site

Write Permissions

w · write

Upload permission

• Upload new files
• Move/copy files into this folder
• Create new subdirectories
• Requires r permission to see uploaded files

accs:
  rw: alice  # alice can read and write
  w: bob     # bob can upload but not see files (write-only)

m · move

Move permission

• Move files/folders from this folder to another
• Rename files within the folder
• Requires w permission at destination

[/incoming]
  /mnt/incoming
  accs:
    w: *    # anyone can upload
    rm: ed  # ed can browse and move files out

d · delete

Delete permission

• Permanently delete files
• Permanently delete folders
• Cannot be undone (unless using unpost feature)

accs:
  rwd: admin  # admin can read, write, delete

Special Permissions

. · dots

Dotfiles permission

User can enable the option to show dotfiles (hidden files) in listings.

• See files/folders starting with .
• Toggle visibility in settings
• Dotfiles still accessible by direct URL regardless

accs:
  r.: alice  # alice can read + see dotfiles

See dotfiles configuration for more details.

a · admin

Admin permission

• See upload timestamps
• See uploader IP addresses
• Reload configuration
• Access control panel features
• View system information

accs:
  ra: admin  # admin can read + admin features

A · all

All permissions combined

Shortcut for rwmda. (read/write/move/delete/admin/dotfiles)

accs:
  A: superuser  # superuser has all permissions

Permission Combinations

Common Patterns

Public Read-Only

[/public]
  /mnt/public
  accs:
    r: *  # everyone can browse and download

Write-Only Drop Box

[/dropbox]
  /mnt/dropbox
  accs:
    w: *     # anyone can upload
    A: admin # admin has full access
  flags:
    e2d      # enable database for tracking uploads
    nodupe   # reject duplicate files

User-Specific Folders

[/alice]
  /mnt/users/alice
  accs:
    A: alice   # alice has full control
    r: admin   # admin can view

[/bob]
  /mnt/users/bob
  accs:
    A: bob
    r: admin

Collaborative Workspace

[groups]
  team: alice, bob, charlie

[/workspace]
  /mnt/team
  accs:
    rwmd: @team  # team members can manage files
    r: guest     # guest has read-only access

Anonymous Upload with Links

[/share]
  /mnt/share
  accs:
    wG: *    # anyone can upload and get links
    A: admin # admin can manage everything
  flags:
    e2d
    fk: 6    # 6-character filekeys
    d2t      # disable metadata parsing (security)
    dthumb   # disable thumbnails (security)

Static Website Hosting

[/site]
  /var/www/site
  accs:
    h: *     # serve index.html to everyone
    rw: dev  # developer can update files

Permission Precedence

User Groups

Permissions can be granted to:

• Individual users: alice, bob
• Groups: @team, @admins
• Everyone: *
• Logged-in users: @acct

Granting and Revoking

accs:
  r: *,-@acct     # everyone EXCEPT logged-in users
  r: @team,-alice # team members except alice
  rw: @admins     # all admins have read-write

Permissions are additive within a user’s grants. A user with both r and w can read and write.

Volume Inheritance

Permissions do not inherit from parent volumes. Each volume has independent permissions.

[/]           # root volume
  /srv
  accs:
    r: *      # everyone can read root

[/private]    # sub-volume with different permissions
  /srv/private
  accs:
    r: admin  # only admin can read /private

Visitors can see that /private exists (from the root volume) but cannot open it unless they have permission.

Authentication Requirements

Password Protection

Volumes require authentication if no * (everyone) permission is granted:

# Requires login
[/secured]
  /mnt/secured
  accs:
    r: alice, bob  # only alice and bob can access

# No login required
[/public]
  /mnt/public
  accs:
    r: *  # everyone can access

Mixed Access

[/mixed]
  /mnt/mixed
  accs:
    r: *       # everyone can read
    w: alice   # only alice can write (requires login)

Advanced Features

Unpost Permission

The --unpost feature allows users to delete their own recent uploads even without d permission.

[global]
  e2d            # required for unpost
  unpost: 43200  # 12 hours (default)
  unp-who: 1     # 1=same IP+account, 2=same IP, 3=same account

[/uploads]
  /mnt/uploads
  accs:
    w: *  # anyone can upload
    # anyone can undo their own uploads for 12 hours

Append Permission

Control who can append to existing files:

[global]
  apnd-who: dw  # delete+write required to append (default)
  # Options: no, aw (admin+write), dw, w

[/logs]
  /var/logs
  accs:
    rw: logger  # logger can write and append
  flags:
    apnd_who: w  # override: write permission is enough

Edit Permission

By default, editing files requires rwd (read+write+delete). The --rw-edit option changes this:

[global]
  rw-edit: md,txt  # only need rw for .md and .txt files

[/docs]
  /mnt/docs
  accs:
    rw: editor  # can edit markdown/txt (not delete)
  flags:
    rw_edit: md,txt,conf  # per-volume override

Security Best Practices

Important security considerations:

1. Write-only folders (w without r) prevent uploaders from seeing what they uploaded
2. Get-only access (g) should be combined with filekeys to prevent URL guessing
3. Admin permission (a) reveals uploader IPs - grant carefully
4. Delete permission (d) is permanent - consider using unpost instead

1. Start with minimal permissions

   Begin with read-only (r) and add write permissions as needed

2. Use groups for teams

   Create groups instead of listing individual users repeatedly

3. Separate admin volumes

   Create dedicated volumes for admin-only content

4. Enable unpost for safety

   Use --unpost to allow users to undo accidental uploads

5. Review regularly

   Audit permissions periodically, especially for a and d

Troubleshooting

User can upload but not see files

User has w but not r permission. Add r for visibility:

accs:
  rw: user  # both read and write

User cannot move files between folders

Moving requires m permission at source and w at destination:

[/source]
  accs:
    rm: user  # can read and move FROM here

[/dest]
  accs:
    w: user   # can write (move) TO here

Everyone can access protected volume

Check for * in permissions. Remove to require authentication:

accs:
  r: *      # BAD - everyone can access
  r: alice  # GOOD - only alice can access

Dotfiles not appearing

User needs . permission AND must enable in settings:

accs:
  r.: user  # grant dotfiles permission

Then user enables dotfiles option in the [⚙️] settings tab.