By tpete1k on

I'm using the fileshare module to allow sharing of files for users (authenticated can upload/download, anonymous can only download). The problem is that any authenticated user can create a folder or delete a folder. Is there a way to restrict this access? I only want the admin to be able to create/delete fileshare folders. I've looked in access control and roles, searched the forums etc. but can't figure it out. Is there another module that might work better?

⋅ Categories: Drupal 4.7.x

Comments

JohnColeman’s picture

JohnColeman commented

Fileshare seems really useful but I too would like to prevent users from deleting folders. On my site I allow Content Managers to upload and delete files at the right place in our file system but it's too easy for them to delete a whole directory and its contents by mistake.

Is there a good way of limiting folder create/delete?

Thanks.

dhw1179’s picture

dhw1179 commented

Let me preface this with I'm no programmer and only know enough about PHP to recognize it when I see it. Reading the various posts I think I developed a rough work-around/fix. Thanks goes to dondurito for his post about limiting folder creation and opening my eyes to doing this for deleting files.

Open fileshare.module and go to hook_perm section, approximately line 68. Under function fileshare_perm, I added ,'delete files' as an option. Then go to section that handles deleting files (line 520). Line 528 does a check against access to deleting files. I changed (user_access('modify files') to (user_access('delete files'). In theory this should then check if they have access to delete files as was created in the first part. Reupload the module, go to Access Control, check delete files under fileshare for the appropriate roles, and voila it should work. All roles can see the red X to delete the file, but if they click on it they get a message saying they do not have that permission.

A copy of my code: first part (includes a fix from dondurito http://drupal.org/node/129445)

/**
 * Implementation of hook_perm().
 *
 * Since we are limiting the ability to create new nodes to certain users,
 * we need to define what those permissions are here. We also define a permission
 * to allow users to edit the nodes they created.
 */
function fileshare_perm() {
  return array('create fileshares'
    ,'set file paths'
    ,'modify files'
    ,'download files'
    ,'manage own fileshares'
	,'create directories'
	,'delete files'
  );
}

and the second part

/**
 * Handles the delete file request by submitDelete in fileshare.js
 */
function _fsform_validate($form_id, $form_values) {
  global $user;
  $node = node_load($form_values['nid']);
  // ensure that you are only deleting files from the file directory and build path from node
  $deletefile = $node->_basepath.$node->_filepath.trim(str_replace('../', '', $form_values['deletefile']),".");
  // checks user access and confirms that the delete string is within the root, but is not the root itself
  if ((substr($form_values['deletefile'],0,1) == '/' && strlen($form_values['deletefile']) > 2) && (user_access('delete files') || (user_access('manage own fileshares') && ($user->uid == $node->uid)))) { 
    if (file_check_directory($deletefile)) {
      if (_recursive_rmdir($deletefile)) {
        drupal_set_message('The folder and it\'s contents: <strong>"'.basename($deletefile).'"</strong> has been deleted.');
        watchdog('fileshare', check_plain($deletefile." and it's contents were deleted from ".$node->title), WATCHDOG_NOTICE, l(t('view'), 'node/'.$node->nid));
      } else {
        drupal_set_message('The folder: <strong>"'.basename($deletefile).'"</strong> could not be deleted.','error'); 
        return FALSE;
      }
    } else {
      if (file_delete($deletefile)) {
        drupal_set_message('The file: <strong>"'.basename($deletefile).'"</strong> has been deleted.');
        watchdog('fileshare', check_plain($deletefile.' was deleted from '.$node->title), WATCHDOG_NOTICE, l(t('view'), 'node/'.$node->nid));
      } else {
        drupal_set_message('The file: <strong>"'.$deletefile.'"</strong> could not be deleted.','error'); 
        return FALSE;
      }
    }
  } else {
    drupal_set_message('You are not authorized to remove: <strong>"'.$deletefile.'"</strong>.','error');
  }
}

If this is terribly wrong, someone please advise me. If it works, I'm glad to have helped.