O96u
8408d01197
GitHub Release / release (push) Canceled after 0s
ci / ci (22, ubuntu-latest) (push) Canceled after 0s
Publish Docker image / build (linux/amd64, ubuntu-latest, amd64) (push) Canceled after 0s
Publish Docker image / build (linux/arm64, ubuntu-24.04-arm, arm64) (push) Canceled after 0s
Publish Docker image / merge (push) Canceled after 0s
2.2 KiB
2.2 KiB
Users & permissions
PicHost uses role-based access control (RBAC): admin and user. Enforcement is server-side.
Role capabilities
| Capability | Admin | User |
|---|---|---|
| Upload images | ✓ | ✓ |
| Own gallery | ✓ | ✓ |
| All galleries / uploader badges | ✓ | — |
Storage management (/storage) |
✓ | — |
System settings (/settings) |
✓ | — |
| Allow registration | ✓ | — |
| Global API token | ✓ | — |
| Personal API token | ✓ | ✓ |
| Gallery stats overview (incl. user count) | ✓ | partial |
| Activity log (Settings → Activity log) | ✓ | — |
Regular users see API, Gallery in the nav; user menu: Change password, Sign out.
Auth scenarios
| Scenario | Auth | Ownership / visibility |
|---|---|---|
| Web upload | Session cookie | Current user |
| API upload + user token | Auth-Token header |
Token owner |
| API upload + global token | Auth-Token header |
Admin (userId null) |
Twikoo POST /api/index.php |
form token |
Same as global token |
| Gallery list / search / delete | Session or token | Users: own only; admin: all |
Direct link GET /images/... |
None (Referer rules) | Public if URL is known |
Accounts
- By default only admins create users; allow registration is an admin setting
- Passwords hashed with scrypt
- Web login requires a slider captcha (align the thumb with the gap)
- Login rate limiting
Upload preferences & auto-delete
- Upload preferences: admins configure client compression and auto-copy in Settings → Basic; regular users can flip the home upload card for personal preferences
- Auto-delete: global (admin) and per-user policies; affects new uploads after enable only
API tokens
| Type | Managed by | Upload owner | Typical use |
|---|---|---|---|
| Global | Admin (API page) | Admin account | Twikoo, site-wide scripts |
| Personal | Each user (API page) | That user | Personal blog, private scripts |
API_UPLOAD_TOKEN in env locks the global token — see Environment variables.