Access content permissions not followed

Moving this issue here because it happens outside of lightbox2. It seems content access permissions for imagecache2 aren't enforced. If we have some permissions is to make use of them, isn't it?

Ok. I have been checking imagecache.module code. I see the only place where permissions are being enforced is in function imagecache_cache_private(). It seems these permissions were thought for the private file system. Now I remember that usually file permissions are only enforced when the filesystem is private, for public filesystem it is apache who serves the files. It means that if I want some files to be protected, they must sit in a private place for the dupal hooks to be launched.

But, as the preset file is created by imagecache, I understand its URL is rewritten through imagecache. That way, even in public file systems, function imagecache_cache is called, and I understand this function should also check permissions. Would it be possible that imagecache denies an url when the view permissions aren't fullfilled so we can simulate this in a public file system? Yes, the users will of course still be able to enter the files directory, but would that be possible?

I think I have located the problem. I propose a modification for imagecache in this line:

function imagecache_create_url($presetname, $path) {
  if (!user_access('view imagecache '. $presetname)) {
    $path = 'default-403error-image.jpg';
  }
  $path = _imagecache_strip_file_directory($path);
  switch (variable_get('file_downloads', FILE_DOWNLOADS_PUBLIC)) {
    case FILE_DOWNLOADS_PUBLIC:
      return url(file_directory_path() .'/imagecache/'. $presetname .'/'. $path, NULL, NULL, TRUE);
    case FILE_DOWNLOADS_PRIVATE:
      return url('system/files/imagecache/'. $presetname .'/'. $path, NULL, NULL, TRUE);
  }
}

I tried it before at theme level with this code:

function mytheme_imagecache($namespace, $path, $alt = '', $title = '', $attributes = null) {
  // check is_null so people can intentionally pass an empty array of attributes to override
  // the defaults completely... if
  if (is_null($attributes)) {
    $attributes['class'] = 'imagecache imagecache-'. $namespace;
  }
  $attributes = drupal_attributes($attributes);
  if (user_access('view imagecache '. $namespace))
    $imagecache_url = imagecache_create_url($namespace, $path);
  else
    $imagecache_url = imagecache_create_url($namespace, 'default-403error-image.jpg');
  return '<img src="'. $imagecache_url .'" alt="'. check_plain($alt) .'" title="'. check_plain($title) .'" '. $attributes .'\ />';
}

But it only works when an image is themed, and doesn't work for URLs. There is, for example, the lightbox2 module that has its own theme for image managing and then they display the image based on the url obtained. Thus, it's imagecache who must send the URL taking into account user permissions.

What do you think?

Excuse me for changing back this to active, I did it only to ask another thing.

Would it be possible to create a theme function so that this could be programmed locally? I mean a theme_imagecache_create_url so that it could be done without modifying the imagecache source code? I don't really understand what you mean (that permissions cannot be enforced for public files) because I have done it. I understand what you mean, that permissions are designed for private file system. But since imagecache rewrites addresses, it can be done internally even for public file system. In any case, I only would like to be able to alter imagecache basic functionality from my theme without touching the original code, nothing more.

Thanks

Yes, I agree, images are only harder to find, but it's ok for me. Enforcing wasn't the correct name. I wanted that the functionality for anon users simulated that of registered users. I don't care if some freak wastes hours of his life searching for the images. There they are for him to find :) Can you tell me, how can I write a theme override? I am not too experienced and I am only used to write theme_ functions. I tried overriding from the theme and I got a duplicate function definition error.