My users generates different export, with specific content access.
A user can have access to any export file from another user simply by changing the eid value from the feed url.
The idea is to restrict access to export file by comparing the current user and the export file author. I add a permission for a full export file access.
I'm sure there is a best way to do it, but it is quick.
| Comment | File | Size | Author |
|---|---|---|---|
| views_data_export-add_permissionsl.patch | 527 bytes | bneel | |
| views_data_export-add_file_access_control.patch | 1.09 KB | bneel |
Comments
Comment #1
steven jones commentedThe patch files aren't valid, but the approach is sound I think, we shouldn't let other users download other user's exports for sure.
Comment #2
steven jones commentedSorry for the lack of attention to your issue, please accept my apologies.
Drupal 7 is going to be end-of-life'd by the community in approximately 1 month.
As such, I am closing all non-critical looking, non-PHP compatibility issues for Views Data Export to tidy up the issue queues and reduce the noise. You can read about this on #3492246: Close down Drupal 7 issues.
If you feel like this issue has been closed by mistake, please do comment about re-opening it.
If you feel like the ticket is still relevant for the 8.x-1.x version of the module, then please search for a duplicate issue first, and if there really isn't one (and you've looked properly) then change the version on the ticket and re-open.
Thanks to everyone involved in this issue: for reporting it, and moving it along, it is truly appreciated.
The Drupal community wouldn't be what it is today without your involvement and effort, so I'm sorry that we couldn't get this issue resolved. Hopefully we'll work together in a future issue though, and get that one resolved :)