The entity browser relies on Views to display a global (site-wide) list of files and images by default. While this is convenient, it runs into access control issue for more complex sites where global access to private files/images can be compromised.

The access controls offered by Views modules (Role and Permissions) are not quite sufficient, supporting a more granular access control as those offered by Views Entity Operation Access module is perhaps a possible way to get desired access control. However at present the Entity Browser's view does not support configuration that is necessary to support this. It would be great if VEOA module or its functionality can be directly supported by Entity browser.

Please advise

Comments

toamit created an issue.

marcoscano’s picture

marcoscano
Primary language Portuguese, Brazil
Location Barcelona, Spain
commented

I'm not familiar with https://www.drupal.org/project/veoa , but if I'm reading the project page right, it only works with page displays. Perhaps the easiest path to the use case you mention is to have that module support also other non-page display types?

toamit’s picture

toamit commented

I have filed an issue about this at the veoa module here. However, that module uses url/path arguments to filter out items and since entity browser is not tied to url/path that method won't work.

A possible approach for entity browser may be to provide additional access control methods exposed via Views.
for
a) e.g. Views Access

  1. All published files
  2. Public and published files
  3. Private and published files
  4. etc.

b) A better approach may be to expose a method similar to veoa module, but one that would work with entity browser.