Problem/Motivation

A group member with group role that allows her to add and edit media entities to group who doesn't have a site role with 'create' or 'edit' new content (nodes) is not able to add media entities via media library to a group page.

Steps to reproduce

- Create a user without site permissions to create or edit nodes
- Create a group and add the user as member
- Create a group role with permissions to add node entities and relations and add this role to the member
- Try to create add an entity (node) that has a media field that uses media library. Select a previously uploaded image and try to add it to the entity.
- It will fail in JavaScript console with 403 permission denied

Proposed resolution

- Take into account that group roles with permissions to add entities and relations should be enough as an access check validation and not rely just on site permissions because this is a group module.

Remaining tasks

- Patch
- Review
- Test

CommentFileSizeAuthor
#5 groupmedia-3238469-5.patch2.04 KBludo.r

Comments

barrio created an issue. See original summary.

akalam’s picture

akalam commented
Issue summary: View changes
a.dmitriiev’s picture

a.dmitriiev commented
Related issues: +#3232139: Media items are not displayed in subgroup

Media library widget at the moment has no context to know that it is opened within any group. There is also related issue, so I added it here.

rgristroph’s picture

rgristroph commented

I think I am also seeing this issue.

ludo.r’s picture

ludo.r
Location Brussels
commented
Status: Active » Needs review
StatusFileSize
new groupmedia-3238469-5.patch2.04 KB

As stated in the title, the groupmedia module does not check the group permissions to create the media entities. It relies on creating group relations, which is not exactly the same.

This patch provides an access check to match the create permissions.
It applies only for the entity.group_content.group_media_add_page route (/group/1/media), and return allowed if user has permissions, otherwise neutral.

lobsterr’s picture

lobsterr commented
Related issues: +#3071489: Incorrect Access Check on Media Library

  • LOBsTerr committed d931984b on 8.x-2.x authored by Ludo.R 
    Issue #3238469 by Ludo.R, LOBsTerr: Groupmedia is not checking group...
lobsterr’s picture

lobsterr commented
Status: Needs review » Fixed

Thank you for your contribution

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

hydra’s picture

hydra commented

Is there a particular reason that this has not been fixed for 4.0.x as well?

hydra’s picture

hydra commented

nvm - I see it has been adjusted to group_relationship, but still the upload does not work in media library modal without the global permission "create media" - I will open a new issue for that.

lobsterr’s picture

lobsterr commented

@Hydra, it has been done already. Check the latest release. I was working on the release porting some commits from 2 version to 3 and then to 4 version and it took me some time

https://git.drupalcode.org/project/groupmedia/-/commit/d3c65fd13fa05c0940b754f0b9743ad10c5f234f

hydra’s picture

hydra commented

Yeah I stumbled on this. I think we need to add an additional AccessControlHandler on the Media entity in order to allow the upload via media library modal (not on the relationship create form itself)

lobsterr’s picture

lobsterr commented

Yes, I can do it later. For the moment. I just decided to port as it is.

msnassar’s picture

msnassar commented

Hello @Hydra and @LOBsTerr

We have encountered the same issue on a website. We have fixed the issue locally. But now as we need do to the same for new website, I have created a contrib module Group Media Library. The module comes with some useful sub-modules: integration with the groupmedia, a fix for https://www.drupal.org/project/group/issues/3071489, and media tracker for media library...

msnassar’s picture

msnassar commented

@LOBsTerr @Ludo.R

I started to update groupmedia module from 8.x-2.0-alpha11 to 8.x-2.0-rc2 for a website.

As I understand from #5, the patch, is not fixing the media library issue. But the access to media for the entity.group_content.group_media_add_page route (/group/1/media). Anyway, I wonder if the patch in #5 is the write way to fix the issue with the route (/group/1/media):

  • If a website has a custom access handler for checking the access, the custom access handler won't be taken into consideration as the patch is just checking the access using group permissions. I think - the best way - is to fix the issue in the group module (this is because the same issue is happening with other entity types e.g. nodes). This has been already fixed in group 2 and 3 (See next point)
  • As mentioned in #12: The same patch has been used for version 3 and 4. Do we still need this for version 3 and 4? Group module version 2 and 3 do check the access already here https://git.drupalcode.org/project/group/-/blob/3.0.x/src/Entity/Control.... This is not the case with group 1. See here https://git.drupalcode.org/project/group/-/blob/8.x-1.x/src/Entity/Contr...