When files are attached as image nodes to another node, and deleting the images is not allowed using the nodeaccess module any user that has 'edit' permissions can still delete the uploaded files through the 'attach' subform on the 'edit' page for the parent node.

The way to do it is to check the 'delete' checkbox on the edit page and then hit submit, the child node with the image will be deleted even though that permission is not given.

I think that the checkboxes should not have appeared and that the delete should have been refused because of a lack of permissions, so that's really two failures (even if the checkboxes do appear the delete should have been refused, then it would have been a less severe issue).

Comments

mantyla’s picture

mantyla commented
Status: Active » Closed (fixed)

This is Nodeaccess working as intended. Nodeaccess only manages view, edit and delete rights to nodes. Attached files are not nodes, and users with the edit right should have the right to delete them. Managing the delete rights of attachments, if it needs to be managed at all, is the job of the file attachment module used.