Site files located in a subfolder cannot be accessed by normal users

Bug #1224750 reported by Kristina Hoeppner on 2013-09-13
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Mahara
Medium
Son Nguyen

Bug Description

This is the original bug report on bug #1223069. Because the discussion went into a different direction and a different feature developed which does not address this issue here directly, I created a new report.

According to the Site Files documentation, files uploaded into the site files section are meant to be accessible to all logged-in users (via the "Site Files" tab on any file selector). The one exception to this is files in the hard-coded "Public" folder, which are meant to also be accessible to users who aren't logged in.

A user on the #mahara irc channel reported that Site Files sitting in a subdirectory, however, are not accessible to normal users. I verified this behavior in 1.8dev.

To reproduce:

1. Log in as an admin user
2. Go to the Site Files page
3. Create a subdirectory
4. Upload a file into that subdirectory
5. Log in as a non-admin user
6. Add a "files to download" block to a page
7. In the block's file selector, go to the "site files" page
8. You will not see the subdirectory you created in step 4, or be able to access its files.

Aaron Wells (u-aaronw) wrote :

I think the manual is probably incorrect on this one. It doesn't make sense to have a Site Files directory of files that are "accessible" to Public users. In Mahara a file artefact being "accessible" could mean one of two things. The first is that it could mean a user can view the file, but this is controlled entirely by whether the file is used in a Page that the user can view, so that can't be what's meant here. The second is that it could mean a user can use the file in their Pages, but Public users can't create or edit pages, so it can't mean that either.

I think the intended purpose of the hard-coded "Public" folder is that it's meant to be files that are accessible to all *logged-in* users in the site. In other words, if mahara.org wanted there to be a Mahara logo that was available to all users to add to their Pages, we could put that logo in the "Public" folder in Site Files.

I haven't yet tested to see if that's how the code currently works.

Son Nguyen (ngson2000) wrote :

Hi Aaron;

I createed a sub-folder in the "Public" and uploaded some files, then added them as items of "LInks and resources" menu.
From this menu, everyone even non-logged-in users can view (access) these files. This means all files, folders in the hard-coded "Public" folder should be accessible to everyone.

Reviewed: https://reviews.mahara.org/2838
Committed: http://gitorious.org/mahara/mahara/commit/9a2519b87f27f0abe3989d5ab45eb0879db897ab
Submitter: Robert Lyon (<email address hidden>)
Branch: master

commit 9a2519b87f27f0abe3989d5ab45eb0879db897ab
Author: Son Nguyen <email address hidden>
Date: Thu Dec 19 08:39:34 2013 +1300

Fix the accessibility to public site files (Bug 1224750)

Change-Id: I04eec56e705932d38da4968e1ddc692dcc00b515
Signed-off-by: Son Nguyen <email address hidden>

Aaron Wells (u-aaronw) on 2014-02-26
Changed in mahara:
milestone: none → 1.9.0
status: Confirmed → Fix Committed
assignee: nobody → Son Nguyen (ngson2000)
Aaron Wells (u-aaronw) wrote :

Okay, I see it now. The text on the Site Files page explains it better.

1. All files in Site Files can be chosen from the "Site Files" section of the artefact chooser, for use in pages, by any user.

2. All files in Site Files can be accessed by a download URL like http://example.com/artefact/file/download.php?file=7 , by any logged-in user, whether or not that file is also used in a page visible to that user.

3. All files in the "public" directory of Site Files can be accessed by a download URL like http://example.com/artefact/file/download.php?file=7 , by LOGGED-OUT users, whether or not that file is also used in a page visible to the public.

So these are perhaps the only file uploads in Mahara which can be viewed by non-logged-in users without having to be embedded in a page.

tags: added: usermanualupdate
Robert Lyon (robertl-9) on 2014-04-22
Changed in mahara:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers