Image artefact in title description of group view is not visible logged out users

[Don Presant]

See example in this public view at:
http://careerportfolio.mb.ca/view/view.php?id=332

Logged in users can see it fine, whether members of the group or not.

mahara 1.3.3
Linux, MySQL

IE 8.0 (FF is OK)

[Stuart McDonald (stuart-catalyst)]

What I'm seeing against current HEAD is that if you add an image artefact to a group and display it in a view (ie drag in a file and select the desired image), then add an <img> element linking to that image in the Title description (ie using the same url as the block), the image will display in the description. If you delete the block (which you would if you wanted the image to display in the description only), the <img> link in the description region is broken.

I'm seeing this behaviour regardless of whether the user is logged in or not.

My interpretation of the behaviour is that access to group artefacts is forbidden unless they are available in a particular context (eg added as a block to a view). The use case of displaying an artefact not otherwise selected as a block has not been catered for.

I'm not sure whether the current behaviour is a feature or a bug. I guess it depends whether a group view's description field is intended to be text-only or potentially interact with any group assets. This is a design call that a senior Mahara developer should make, so I'm parking work on this bug until someone makes a call :).

[Hugh Davenport (hugh-davenport)]

I think this bug may be the following:

Create a new group, in description say drag the mahara logo down (not an artefact or anything). Logged in users can view the home page whether they are a member or not. But non logged in users can't even view the home page (they get a login screen).

I think it is more abstract than the artefacts not being able to be viewed (i think that is a feature not a bug as if an artefact is removed it shouldn't be linked to within mahara, so external links (or links in descriptions) would be broken). I think it is just the fact the logged out users can't view group home pages (whether there is an image in them or not...)

But again, we would need clarification whether that is a feature or a bug.

Cheers,

Hugh

[Hugh Davenport (hugh-davenport)]

I completely forgot about the publically viewable group checkbox...

[Don Presant (don-learningagents)]

Does this mean that a sitewide image might work?
Group is now publicly viewable - no difference.

BTW, I just checked again.
In FF, I went without being logged in and saw the page without the header graphic. I saw a message prompting me to log in, and when I did, I saw the graphic.
In IE, no message about logging in, and a big broken graphic box

[Richard Mansfield (richard-mansfield)]

Stuart: So artefacts don't count as being 'in' a view when they appear inside the view description, but don't appear in any block.

They probably should, but I think we should leave this bug till later. It's not too serious and it'll require messing around with the db schema a bit, and we might also want to think about whether we can make it clearer to the view owners exactly what permissions they're placing on things when they go pasting links around like that.

Don: Yes, you should be able to work around this bug using a link to a sitewide image, as long as the site image is in the 'public' directory in Site Files.

You should also be able to do it with any old image, if use the right src link in the img tag as Stuart hinted at, basically something like:

  <img alt="blah" src="http://example.com/artefact/file/download.php?file=123&view=456">

As long as view 456 has public access, and image 123 is in view 456, it should work.

[Don Presant (don-learningagents)]

Thanks Richard, making it a sitewide public file worked a charm. Good to know why it was an issue.
I agree that it's not a high priority, though it does limit what normal users can do in presenting views. Thankfully, I'm an admin and I can just do it. Maybe a low to medium?

[Richard Mansfield (richard-mansfield)]

Don, you shouldn't need to be an admin. If you have non-admin users who want to work around the bug, you can just tell them to put the image into some other public view of their own, and then use that public view's id in the link they put into the description. It's not exactly easy, but it should work.

[Robert Lyon (robertl-9)]

To test/clarify the problem:

1) Create new group - make sure to mark it as 'Publicly viewable group'

2) Upload an image file to the group -> files and get the url of it (right click on name of file and copy link location)

3) Edit the group and in the description field click on the 'image' icon in tinymce. Paste in the image url
- should be something like https://mahara-testing/artefact/file/download.php?file=22
and save the form.
You should be able to see the image as part of the description for the group.

4) Note the url of the group homepage and then logout

5) Navigate to that url again and you should be able to see everything that you would expect - except for the image

The image is not recognized as being attached to the view.

The workaround mentioned earlier does not work any more as now there are checks in place to make sure the artefact is connected to the view and it is the view we are seeing.

[Kristina Hoeppner (kris-hoeppner)]

This was fixed elsewhere in Mahara 17.04 or 17.10.