Problem
A very common need is collecting files from many separate people: a lawyer, accountant, or therapist gathering documents from each client; a teacher receiving homework; a job posting receiving CVs.
Today Drive can't do this. #706 asks for anonymous upload, but only via Public + Editor, which would let every contributor see and edit everyone else's files. For the use cases above that isn't just wrong, it's a confidentiality breach: client A must never see client B's documents.
Proposal: an upload-only (write-only) link mode
A link that grants create-only access — a recipient can add files but cannot list, download, or edit what's already there.
- A new link role (e.g.
contributor) below editor: children_create = yes; children_list / download / retrieve = no.
- Allow this role to create anonymously (the owner explicitly opts the link into it), unlike the current gate
can_create_children = can_update and user.is_authenticated.
- Ensure the item queryset never exposes a folder's children through such a link.
- Frontend: expose the mode in the share modal, and render a minimal drop-zone view (no file listing) for these links.
- Reuse the existing per-link password + expiry; lean on the existing malware scanning; add per-link size/quota/rate limits for abuse.
Relation to #706
#706 covers anonymous upload in general (Public + Editor). This issue is the confidentiality-preserving variant that most real "collect files from people" workflows actually need. They likely share a backend foundation (allowing anonymous creation).
Prior art
- Nextcloud "File requests"
- Seafile "upload links"
Offer to implement
Happy to build this — we run Drive in production at email.eu (a sovereign EU workspace) and hit this with a real customer, so contributing it upstream is the natural path. I can open a backend draft PR for the role + abilities (and the anonymous-create path), with a frontend drop-zone view as a fast-follow. Design input welcome, in particular whether you'd prefer a new link role vs. a dedicated "file request" object.
Problem
A very common need is collecting files from many separate people: a lawyer, accountant, or therapist gathering documents from each client; a teacher receiving homework; a job posting receiving CVs.
Today Drive can't do this. #706 asks for anonymous upload, but only via Public + Editor, which would let every contributor see and edit everyone else's files. For the use cases above that isn't just wrong, it's a confidentiality breach: client A must never see client B's documents.
Proposal: an upload-only (write-only) link mode
A link that grants create-only access — a recipient can add files but cannot list, download, or edit what's already there.
contributor) beloweditor:children_create= yes;children_list/download/retrieve= no.can_create_children = can_update and user.is_authenticated.Relation to #706
#706 covers anonymous upload in general (Public + Editor). This issue is the confidentiality-preserving variant that most real "collect files from people" workflows actually need. They likely share a backend foundation (allowing anonymous creation).
Prior art
Offer to implement
Happy to build this — we run Drive in production at email.eu (a sovereign EU workspace) and hit this with a real customer, so contributing it upstream is the natural path. I can open a backend draft PR for the role + abilities (and the anonymous-create path), with a frontend drop-zone view as a fast-follow. Design input welcome, in particular whether you'd prefer a new link role vs. a dedicated "file request" object.