[Mahara-contributors] [Bug 1223069] Re: Site files located in a subfolder cannot be accessed by normal users
Just submitted a patch to gerrit: https://reviews.mahara.org/#/c/2493/ -- You received this bug notification because you are a member of Mahara Contributors, which is subscribed to Mahara. Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it! https://bugs.launchpad.net/bugs/1223069 Title: Site files located in a subfolder cannot be accessed by normal users Status in Mahara ePortfolio: Confirmed Bug description: According to the Site Files documentation, files uploaded into the site files section are meant to be accessible to all logged-in users (via the Site Files tab on any file selector). The one exception to this is files in the hard-coded Public folder, which are meant to also be accessible to users who aren't logged in. A user on the #mahara irc channel reported that Site Files sitting in a subdirectory, however, are not accessible to normal users. I verified this behavior in 1.8dev. To reproduce: 1. Log in as an admin user 2. Go to the Site Files page 3. Create a subdirectory 4. Upload a file into that subdirectory 5. Log in as a non-admin user 6. Add a files to download block to a page 7. In the block's file selector, go to the site files page 8. You will not see the subdirectory you created in step 4, or be able to access its files. To manage notifications about this bug go to: https://bugs.launchpad.net/mahara/+bug/1223069/+subscriptions ___ Mailing list: https://launchpad.net/~mahara-contributors Post to : mahara-contributors@lists.launchpad.net Unsubscribe : https://launchpad.net/~mahara-contributors More help : https://help.launchpad.net/ListHelp
[Mahara-contributors] [Bug 1223069] Re: Site files located in a subfolder cannot be accessed by normal users
Sorry, I just read the bug report again. The behaviour that I was talking about was the following: 1. Log in as an admin user 2. Go to the Site Files page 3. Create a subdirectory 4. Upload a file into that subdirectory 5. go to the 'links and resources' menu 6. select 'Logged-in links and resources' 7. Check 'Site file' and select the uploaded file and add the new entry 8. Log in as a non-admin user 9. click on the newly created link in the 'links and resources' block 10. you get an 'access denied' error The patch that I submitted fixes this issue. -- You received this bug notification because you are a member of Mahara Contributors, which is subscribed to Mahara. Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it! https://bugs.launchpad.net/bugs/1223069 Title: Site files located in a subfolder cannot be accessed by normal users Status in Mahara ePortfolio: Confirmed Bug description: According to the Site Files documentation, files uploaded into the site files section are meant to be accessible to all logged-in users (via the Site Files tab on any file selector). The one exception to this is files in the hard-coded Public folder, which are meant to also be accessible to users who aren't logged in. A user on the #mahara irc channel reported that Site Files sitting in a subdirectory, however, are not accessible to normal users. I verified this behavior in 1.8dev. To reproduce: 1. Log in as an admin user 2. Go to the Site Files page 3. Create a subdirectory 4. Upload a file into that subdirectory 5. Log in as a non-admin user 6. Add a files to download block to a page 7. In the block's file selector, go to the site files page 8. You will not see the subdirectory you created in step 4, or be able to access its files. To manage notifications about this bug go to: https://bugs.launchpad.net/mahara/+bug/1223069/+subscriptions ___ Mailing list: https://launchpad.net/~mahara-contributors Post to : mahara-contributors@lists.launchpad.net Unsubscribe : https://launchpad.net/~mahara-contributors More help : https://help.launchpad.net/ListHelp
[Mahara-contributors] [Bug 1223069] Re: Site files located in a subfolder cannot be accessed by normal users
An update on this. From comments in the code, and an analysis of how this works, it looks like the original intent on how this was meant to work is as follows: 1. Site Files in the public directory can be chosen in the file selector by admins and non-admins (for attaching to Blocks, for instance) 2. Site Files outside the public directory cannot. So it would seem that the proper fix would be: 1. Update the documentation to reflect this 2. Make it so that no files outside of the public directory can be chosen in the file selector by non-admins. However, if we were to implement that change, we would have to watch out for existing sites where non-admin users are relying on files placed in the root level of Site Files. We'd need to move these into the Public directory so they remain accessible, and doing this could cause some disruption (for instance if there's already a file in the Public directory with the same name). So, it's kind of a major change that would need to be made during a major release. And unfortunately it's too late to include it in 1.8 at this point, so it'll have to wait for 1.9. -- You received this bug notification because you are a member of Mahara Contributors, which is subscribed to Mahara. Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it! https://bugs.launchpad.net/bugs/1223069 Title: Site files located in a subfolder cannot be accessed by normal users Status in Mahara ePortfolio: Confirmed Bug description: According to the Site Files documentation, files uploaded into the site files section are meant to be accessible to all logged-in users (via the Site Files tab on any file selector). The one exception to this is files in the hard-coded Public folder, which are meant to also be accessible to users who aren't logged in. A user on the #mahara irc channel reported that Site Files sitting in a subdirectory, however, are not accessible to normal users. I verified this behavior in 1.8dev. To reproduce: 1. Log in as an admin user 2. Go to the Site Files page 3. Create a subdirectory 4. Upload a file into that subdirectory 5. Log in as a non-admin user 6. Add a files to download block to a page 7. In the block's file selector, go to the site files page 8. You will not see the subdirectory you created in step 4, or be able to access its files. To manage notifications about this bug go to: https://bugs.launchpad.net/mahara/+bug/1223069/+subscriptions ___ Mailing list: https://launchpad.net/~mahara-contributors Post to : mahara-contributors@lists.launchpad.net Unsubscribe : https://launchpad.net/~mahara-contributors More help : https://help.launchpad.net/ListHelp
