Anonymous users get a HTTP Error when sending files. [#1465000]

Error occurs even with access rights granted for anon users to use the module ("Allow user to upload files via Plupload.").

Works well for authenticated users with the same access rights.

Could the error come from the fact that anonymous users have a limited access to the file directory used to temporarily store the uploaded files?

Comment	File	Size	Author
	error plup.png	18.28 KB	Louis Bob

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

Anonymous (not verified) CreditAttribution: Anonymous commented 3 March 2012 at 11:49

Status:

Active

» Closed (works as designed)

No. Anonymous users cannot use Plup module. If you want to change that you have to edit the code. Find the plup_upload_access() function on #32 in plup.module and in it there is:

return !empty($_REQUEST['plupload_token']) && drupal_valid_token($_REQUEST['plupload_token'], 'plupload-handle-uploads');

Change it to:

return !empty($_REQUEST['plupload_token']) && drupal_valid_token($_REQUEST['plupload_token'], 'plupload-handle-uploads', TRUE);

That should do the trick.
Reason for this behavior is to protect your site from attackers being able to upload files into your server and run malicious code. When you start uploading files drupal wil add unique token to the request for the current user and the receiving page will validate this token.

I discourage you to change this behavior due to the security issue but if you really need this no one's stopping you.