OpenList needs a migration review, not just a guest toggle
OpenList is a web-based file manager and a drop-in replacement for AList. Its documentation emphasizes multiple storage providers, WebDAV, guest access controls, and user permissions. Those features are also the areas where a migration can carry old assumptions into a new control plane.
A team that replaces AList may copy storage definitions, tokens, user paths, and sharing behavior. Each of those items deserves a fresh authorization review. A setting that was acceptable in one deployment may expose a different provider or a broader file tree after migration.
A title-only observation
On 2026-11-01, the ZoomEye SDK query title="OpenList" returned 4,025 matches at sub_type=all, page 1, and pagesize 1. The app="OpenList" query returned 0. The title result is a useful discovery signal for a product whose exact application fingerprint was not observed in this scope. It does not prove that all matches are reachable file listings or that any stored content is public.
OpenList's documentation warns that guest access may be disabled and that login may be required. It also ties WebDAV write operations to a separate management permission. A migration review should verify both the visible setting and the effective permission path.
Compare old and new mounts
Export the old mount list without credentials, then create the same inventory for OpenList. Map each mount to a storage provider, an owner, a refresh token or service credential, and the paths that users can see. Confirm that a token issued for one provider is not mounted into a path controlled by another tenant.
Test guest behavior before and after login. Attempt a directory listing, a file read, a link share, and a WebDAV write with each relevant account. Remove a user's permission and verify that existing links and WebDAV sessions stop working. A cached directory page or a long-lived session should not preserve access after the account change.
Check the migration artifacts. Old backup files, environment files, reverse-proxy rules, and browser bookmarks can expose the previous hostname. A new service name does not remove an old virtual host. Remove stale DNS entries and confirm that the old deployment is not still accepting requests.
The title count places OpenList in the internet measurement set. The migration check determines whether its storage definitions, tokens, and guest policy were actually carried over with an owner.
Top comments (0)