Restrict access to download backups

Hi there,

I'm sorry the current permissions don't suit your need but given how destructive this module can be there isn't a whole lot of point in making the permissions to fine-grained so I don't plan on expanding them to any major degree. Basically, my philosophy here is that if you can't trust your users completely (both their integrity and their competence) then they shouldn't have any access to B&M whatsoever.

- the option for "download" is still available, which might only be puzzling for a non IT person

I guess I understand that, but if you trust your user with the restore function I think you may have to trust them to figure out what 'download' means.

- this give access to any file from any destination

Implementing per-destination access permissions is a big task and not one I would have the bandwidth to take on.

- "restore from backup" and "access backup files" is essentially redundant, but need both top be set to restore database

Not really, I can see the need to allow users to download backup files (for local development, say) but not restore a live site.

- "restore from backup" does not give right to select the destination to restore from

You should be able to restore from an upload unless this is broken.

I hope all this makes sense.

It would be _very_ useful if we could allow "any" users to evaluate and test a site while making backups themselves before each major step to the _server_, without the possibility to download the backup.

Imagine how many settings, information, API keys, unpublished posts, user account names/email addresses, etc. can be inside that backup, which such users should not get to.
It is still very useful to offer them a way to secure their work "so far" for each step, so that whenever something goes wrong, a restore can be made by an admin from either the previous state or a given time.

Therefore, I regard a permission to download instead of storing on the server quite important.
Reopening for discussion.

Edit: My point is to be able to use a roles-based permission to limit who can download the backups, to force selected user roles to backing up ONLY to the server.
See also: #1811616: Option to restrict downloads to SSL connections.

Anyone care to comment on this?

I think it is a viable use case, and also coupled with non-testing environments:

I would think it was very handy to be able to let some users be able to save a backup to the server without having access to download it.

Furthermore; consider a site that is not using SSL, and users accessing it from a public Wi-Fi network. Those download links are then sent "openly" accross the network for anyone with a basic network tool to grab without a problem.

I wish that we could NOT present the backup links directly on the result page when making backups to the server, but instead provide links to the tab that lists all backups, and set a permission to access that tab.

By using other, existing modules that already deals with URL permissions, it would be possible let them restrict the access to just that tab based on its existing page/URL: /admin/config/system/backup_migrate/backups ).

So perhaps all this module needs to do is to:

a) provide a permission for downloading backups, and for users that has permission to make backups but lack that new permission to download them, the download option will not be available.

b) then, when a backup is made to the server, we do not present the direct backup links along with the success message, but a link to the tab with the backup list instead.

How about that?

Ronan has made it clear that this isn't a recommended feature.