Problem/Motivation
Disabling the "delete files" permission for a folder disables deleting any files in that folder and in any subfolders.
However, enabling the "delete subfolders" permission for a folder allows deleting those files through deleting their folder.
The expected behaviour would be that the above configuration prohibits deleting subfolders that contain files at any level.
Steps to reproduce:
- Edit an imce profile and enable the "Delete subfolders" checkbox and have the "Delete files" checkbox and the "All permissions" checkbox disabled
- Open the imce manager tool and create a subfolder, then enter the subfolder and upload a file
Try to delete this file directly and IMCE will prevent you. - Move back to parent folder, select the previously created subfolder and delete it
The subfolder and the file within will be deleted
Proposed resolution
When deleting a subfolder, check for files and the "Delete files" permission
\Drupal\imce\ImceFM::validatePermissions seems to be the right place but I can't figure out how to pass the subfolder contents to the validator.
// Parent contains subfolders but does not have the subfolder permission
if (!empty($content['subfolders'])) {
if (!isset($subfolder_perm) || !$parent->getPermission($subfolder_perm)) {
return FALSE;
}
//ITERATE THROUGH SUBFOLDERS
foreach ($content['subfolders'] as $subfolder) {
if (!$this->validatePermissions(CONTENTS_HERE, $file_perm, $subfolder_perm)) {
return FALSE;
}
}
//END
}
Comments
Comment #2
Karol Haltenberger CreditAttribution: Karol Haltenberger commentedComment #4
ufku CreditAttribution: ufku commentedCommitted a fix. Thanks for reporting.