mahara-contributors team mailing list archive

[Aaron Wells <1223069@xxxxxxxxxxxxxxxxxx>]

An update on this. From comments in the code, and an analysis of how
this works, it looks like the original intent on how this was meant to
work is as follows:

1. Site Files in the "public" directory can be chosen in the file selector by admins and non-admins (for attaching to Blocks, for instance)
2. Site Files outside the "public" directory cannot.

So it would seem that the proper fix would be:

1. Update the documentation to reflect this
2. Make it so that no files outside of the "public" directory can be chosen in the file selector by non-admins.

However, if we were to implement that change, we would have to watch out
for existing sites where non-admin users are relying on files placed in
the root level of Site Files. We'd need to move these into the Public
directory so they remain accessible, and doing this could cause some
disruption (for instance if there's already a file in the Public
directory with the same name).

So, it's kind of a major change that would need to be made during a
major release. And unfortunately it's too late to include it in 1.8 at
this point, so it'll have to wait for 1.9.

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1223069

Title:
  Site files located in a subfolder cannot be accessed by normal users

Status in Mahara ePortfolio:
  Confirmed

Bug description:
  According to the Site Files documentation, files uploaded into the
  site files section are meant to be accessible to all logged-in users
  (via the "Site Files" tab on any file selector). The one exception to
  this is files in the hard-coded "Public" folder, which are meant to
  also be accessible to users who aren't logged in.

  A user on the #mahara irc channel reported that Site Files sitting in
  a subdirectory, however, are not accessible to normal users. I
  verified this behavior in 1.8dev.

  To reproduce:

  1. Log in as an admin user
  2. Go to the Site Files page
  3. Create a subdirectory
  4. Upload a file into that subdirectory
  5. Log in as a non-admin user
  6. Add a "files to download" block to a page
  7. In the block's file selector, go to the "site files" page
  8. You will not see the subdirectory you created in step 4, or be able to access its files.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1223069/+subscriptions