Enable public statistics gives guest users full access to private albums #71
Label
Kein Meilenstein
Niemand zuständig
1 Beteiligte
Nachrichten
Fällig am
Kein Fälligkeitsdatum gesetzt.
Abhängigkeiten
Keine Abhängigkeiten gesetzt.
Referenz: aheathershaw/blue-twilight#71
Laden…
In neuem Issue referenzieren
Keine Beschreibung angegeben.
Branch "%!s(<nil>)" löschen
Das Löschen eines Branches ist permanent. Obwohl der Branch für eine kurze Zeit weiter existieren könnte, kann diese Aktion in den meisten Fällen NICHT rückgängig gemacht werden. Fortfahren?
LNT00:
Steps:
Note: Statistics is not displayed when not logged in, but can be opened with direct link. Also, seems this is an issue with permissions, only sub-albums are available, main albums that were set as private are not available, so it's probably a permission inheritance issue.
Permissions do not inherit, therefore yes, if a user has access to a child album but not the parent, as far as the system is concerned, they still have access to the child unless you’ve told it otherwise.
If we inherited permissions and you moved a child album from a parent that a user didn’t have permission to, into one they do, you could be inadvertently allowing access to a previously-disallowed album without realising it.
LNT00:
Permissions should be inherited by default. If a user decides to allow access to a child album, then he assumes the action.
When you move a child album from a parent without permissions to a parent with permissions, then you accept that it will inherit the parent. If you still don't want to allow access to it, you can set it's own permission.
Issue came up from my own case, where i created parent albums without permissions, and i assume that everything i add inside will have the same restrictions. Otherwise, i will have to set permissions to each album i create, which i think is very time consuming. In my case i have about 10 parent albums, and 300+ child albums, for which i didn't set individual permissions.
As a workaround, i would suggest at least give the option to automatically set permissions to all content inside an album, or just the edited one.
I understand but I’m just saying it doesn’t work like that at the moment.
I will introduce a “inherit” option that works like Windows folder permissions for child albums but it will increase complexity of the code, particularly the statistics, so it isn’t going to be an immediate change - there are other things I would like to do first.
Migrated from https://github.com/andysh-uk/blue-twilight/issues/71
I've been thinking about this a bit more, and due to the complexity of the logic, it needs to be implemented in code.
This could be cached in the database in a similar way to how we cache disk usage in Blue Twilight Cloud (e.g. a flag indicating the permission cache is dirty.)
The cache will need to be dirtied when the following is true:
a new user is added- not needed as groups don't change until a user is editedAlso we should add a button to the Settings screen that allows an administrator to rebuild the permissions cache.
Subject to testing, this is now complete.
Re-opening this as unless a user is specifically granted permissions via their groups, they cannot see albums that even an anonymous user can!
Therefore every user should inherit the same permissions as anonymous users.
This means we do need to rebuild the cache when a new user is activated or created.
I've implemented this by doing an additional security check against anonymous users first - if that passes, it applies to logged-in users as well, otherwise it falls back to checking a specific user.