Hello,

I can restrict access to a folder (for example "folder1") when using file depot page (www.sitename.com/filedepot) and hide a folder from certain users, but when accessing the same folder as a node (www.sitename.com/content/folder1) there is no access restriction. Everyone be it guest or admin or anyone can access the folder and see a listing of the contents.

How can this be prevented?
Thanks
cat

CommentFileSizeAuthor
#1 filedepot-nodeaccessfix-1572558.patch1.94 KBblainelang

Comments

blainelang’s picture

blainelang commented
Component: Miscellaneous » Code
Assigned: Unassigned » blainelang
Category: support » bug
Status: Active » Needs review
StatusFileSize
new filedepot-nodeaccessfix-1572558.patch1.94 KB

Thanks for reporting this cat, not sure why it was not picked up yet as an issue and I missed it in my testing as well. This is a rather serious bug.

Attached is a patch and I'm going to update DEV right now as well (takes a few hours I think to regenerate a new file)

I've tested it on a couple sites and this should fix the issue. Please test and report back so we can close this issue.

cattalk’s picture

cattalk commented
Status: Needs review » Closed (fixed)

As far as I can tell this problem is solved!

Thanks blainelang!

cattalk’s picture

cattalk commented
Status: Closed (fixed) » Active

Unfortunately I have to reopen this issue. Since I installed the new dev version there are massive problems with anonymous users accessing content on the site. All content types have an access denied error for any role except administrators. When the content is listed in views or blocks there is no problem. When content is viewed on node pages then anonymous users get an access denied error.
I have deactivated filedepot and now every node is viewable by everyone.

Thanks
cat

blainelang’s picture

blainelang commented

Every node as in filedepot_folder nodes?

De-activating filedepot would prevent it's HOOK_node_access from executing which was applying the filedepot specific node access rules. Drupal should now be applying the default access logic - set via permissions.

cattalk’s picture

cattalk commented

When activating the dev version of filedepot the site works ok as long as I only have only filedepot nodes. As soon as I have something like basic page these pages can only be viewed by admins.
I have a site where there are pages for normal visitors with text and marketing fluff and I have a restricted area with file depot. When filedepot is activated anonymous users can no longer access the text and marketing pages, they are mostly made of "basic page" content types and some custom content types.

In filedepot module on line 417:

$ret = NODE_ACCESS_DENY;
 if (!isset($node->nid) OR !isset($node->type) OR $node->type != 'filedepot_folder') {
 return $ret;
 }

Does that mean all other content types get access denied?

thx
cat

blainelang’s picture

blainelang commented

Uh, ok - change that to NODE_ACCESS_IGNORE

So the default is for this HOOK_access to not effect the permissions.

function filedepot_node_access($node, $op) {

$filedepot = filedepot_filedepot();
module_load_include('php', 'filedepot', 'lib-common');
$ret = NODE_ACCESS_IGNORE;
if (!isset($node->nid) OR !isset($node->type) OR $node->type != 'filedepot_folder') {
return $ret;
}
// set the default return to DENY and if user has access return ALLOW
$ret = NODE_ACCESS_DENY;

Try that modified code.

cattalk’s picture

cattalk commented

Cool this does the trick! Thanks a lot for your great support!!

sorry I forgot to close the issue...

blainelang’s picture

blainelang commented
Status: Active » Fixed

Your very welcome, thanks for reporting this issue, your patience and testing!

I will commit the fix and get a new release out today.

- blaine

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

  • Commit c952cfb on 7.x-1.x, 8.x-1.x by blainelang: 
    Fix for issue #1572558 and not restricting access to the folder node via...