It is impossible a user to administer files via media browser plus when his role does not have 'Administer files' grand permission. There is a lot of problems with access, links and buttons. Buttons for view, preview, edit and delete are hidden. Folder management is not working properly and there is no download button for the files in the basket. Also filter links don't work properly.

CommentFileSizeAuthor
#8 media_browser_plus-messed_up_permissions-1973788-8.patch8.91 KBndobromirov
#7 media_browser_plus-messed_up_permissions-1973788-7.patch9.04 KBndobromirov
#6 media_browser_plus-messed_up_permissions-1973788-5.patch8.86 KBmiroslavbanov
#5 media_browser_plus-messed_up_permissions-1973788-4.patch7.78 KBboychev
#4 media_browser_plus-messed_up_permissions-1973788-3.patch0 bytesboychev
#3 media_browser_plus-messed_up_permissions-1973788-2.patch6.28 KBboychev
#1 media_browser_plus-messed_up_permissions-1973788-0.patch7.78 KBboychev

Comments

boychev’s picture

boychev commented
StatusFileSize
new media_browser_plus-messed_up_permissions-1973788-0.patch7.78 KB

And now here is my solution. I've changed the access arguments for some of buttons, links and menu callbacks. Also I've created a new permission 'edit media files' and now it is not necessary to use the 'edit any files' permission. I think it's good to have a separate permission. The logic about showing the links for filtering was wrong. We need to show filters only if they are allowed and then to check if the filter is active or not. Here is my patch for fixing these issues.

boychev’s picture

boychev commented
Status: Active » Needs review

Waiting for review.

boychev’s picture

boychev commented
StatusFileSize
new media_browser_plus-messed_up_permissions-1973788-2.patch6.28 KB

I've handled the case with whitespace errors.

boychev’s picture

boychev commented
StatusFileSize
new media_browser_plus-messed_up_permissions-1973788-3.patch0 bytes

Latest patch.

boychev’s picture

boychev commented
StatusFileSize
new media_browser_plus-messed_up_permissions-1973788-4.patch7.78 KB

The previous patch failed :)

miroslavbanov’s picture

miroslavbanov commented
StatusFileSize
new media_browser_plus-messed_up_permissions-1973788-5.patch8.86 KB

Further issues when 'administer files' permission is missing:
1. When editing a file and then we Click "cancel", we are redirected to /admin/content/file/thumbnails, which causes notices thrown in media_form_file_entity_admin_file_alter().
2. When new file is created, we are redirected to the file/%file path, even though we have access permission to "/admin/content/file" path.

ndobromirov’s picture

ndobromirov commented
StatusFileSize
new media_browser_plus-messed_up_permissions-1973788-7.patch9.04 KB

Added a fix in the the submit handler redirect management.
When an array is passed, the strpos on line 436 generates a warning.
Adding a patch for the fix.

ndobromirov’s picture

ndobromirov commented
StatusFileSize
new media_browser_plus-messed_up_permissions-1973788-8.patch8.91 KB

The last patch generates more issues than it solves. Adding a simpler implementation.

devin carlson’s picture

devin carlson commented

Marked #2007148: Issue with media_browser_plus and restricted permissions as a duplicate.

das-peter’s picture

das-peter commented
Status: Needs review » Fixed

I'm not very happy with the whole permission stuff :| However, this patch surely enhances the current state of the 2.x branch. Even if it isn't backward compatible to older file entity versions.
Thus comitted: http://drupalcode.org/project/media_browser_plus.git/commit/81d80fd
Thanks :)

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.