Enable public statistics gives guest users full access to private albums #71
Rótulos
Sem etapa
Sem encarregados
1 Participantes
Notificações
Data de vencimento
Sem data de vencimento definida.
Dependências
Não estão definidas dependências.
Referência: aheathershaw/blue-twilight#71
Carregando…
Criar uma nova questão referindo esta
Nenhuma descrição fornecida.
Eliminar o ramo "%!s(<nil>)"
Eliminar um ramo é algo permanente. Embora o ramo eliminado possa continuar a existir por um breve período de tempo antes de ser realmente removido, a operação NÃO PODERÁ ser desfeita na maioria dos casos. Quer continuar?
LNT00:
Steps:
Note: Statistics is not displayed when not logged in, but can be opened with direct link. Also, seems this is an issue with permissions, only sub-albums are available, main albums that were set as private are not available, so it's probably a permission inheritance issue.
Permissions do not inherit, therefore yes, if a user has access to a child album but not the parent, as far as the system is concerned, they still have access to the child unless you’ve told it otherwise.
If we inherited permissions and you moved a child album from a parent that a user didn’t have permission to, into one they do, you could be inadvertently allowing access to a previously-disallowed album without realising it.
LNT00:
Permissions should be inherited by default. If a user decides to allow access to a child album, then he assumes the action.
When you move a child album from a parent without permissions to a parent with permissions, then you accept that it will inherit the parent. If you still don't want to allow access to it, you can set it's own permission.
Issue came up from my own case, where i created parent albums without permissions, and i assume that everything i add inside will have the same restrictions. Otherwise, i will have to set permissions to each album i create, which i think is very time consuming. In my case i have about 10 parent albums, and 300+ child albums, for which i didn't set individual permissions.
As a workaround, i would suggest at least give the option to automatically set permissions to all content inside an album, or just the edited one.
I understand but I’m just saying it doesn’t work like that at the moment.
I will introduce a “inherit” option that works like Windows folder permissions for child albums but it will increase complexity of the code, particularly the statistics, so it isn’t going to be an immediate change - there are other things I would like to do first.
Migrated from https://github.com/andysh-uk/blue-twilight/issues/71
I've been thinking about this a bit more, and due to the complexity of the logic, it needs to be implemented in code.
This could be cached in the database in a similar way to how we cache disk usage in Blue Twilight Cloud (e.g. a flag indicating the permission cache is dirty.)
The cache will need to be dirtied when the following is true:
a new user is added- not needed as groups don't change until a user is editedAlso we should add a button to the Settings screen that allows an administrator to rebuild the permissions cache.
Subject to testing, this is now complete.
Re-opening this as unless a user is specifically granted permissions via their groups, they cannot see albums that even an anonymous user can!
Therefore every user should inherit the same permissions as anonymous users.
This means we do need to rebuild the cache when a new user is activated or created.
I've implemented this by doing an additional security check against anonymous users first - if that passes, it applies to logged-in users as well, otherwise it falls back to checking a specific user.