Problem/Motivation

Disabling the "delete files" permission for a folder disables deleting any files in that folder and in any subfolders.
However, enabling the "delete subfolders" permission for a folder allows deleting those files through deleting their folder.

The expected behaviour would be that the above configuration prohibits deleting subfolders that contain files at any level.

Steps to reproduce:

  1. Edit an imce profile and enable the "Delete subfolders" checkbox and have the "Delete files" checkbox and the "All permissions" checkbox disabled
  2. Open the imce manager tool and create a subfolder, then enter the subfolder and upload a file

    Try to delete this file directly and IMCE will prevent you.
  3. Move back to parent folder, select the previously created subfolder and delete it

    The subfolder and the file within will be deleted

Proposed resolution

When deleting a subfolder, check for files and the "Delete files" permission

\Drupal\imce\ImceFM::validatePermissions seems to be the right place but I can't figure out how to pass the subfolder contents to the validator.

      // Parent contains subfolders but does not have the subfolder permission
      if (!empty($content['subfolders'])) {
        if (!isset($subfolder_perm) || !$parent->getPermission($subfolder_perm)) {
          return FALSE;
        }
//ITERATE THROUGH SUBFOLDERS
        foreach ($content['subfolders'] as $subfolder) {
          if (!$this->validatePermissions(CONTENTS_HERE, $file_perm, $subfolder_perm)) {
            return FALSE;
          }
        }
//END
      }

Comments

Karol Haltenberger created an issue. See original summary.

Karol Haltenberger’s picture

Issue summary: View changes

  • ufku committed 525b4ff on 8.x-1.x
    Issue #2773575 by Karol Haltenberger: Delete subfolder permission allows...
ufku’s picture

Version: 8.x-1.3 » 8.x-1.x-dev
Status: Active » Fixed

Committed a fix. Thanks for reporting.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.