It's really a great module but is it possible to set it in a way that if an authenticated user uploads a file it will not be published until the administrator approves the file(s)?

Comments

miguelbraga created an issue. See original summary.

clivesj’s picture

clivesj commented
Category: Support request » Feature request
Priority: Major » Normal
Status: Active » Closed (won't fix)

Hello Miguel,
This feature is not available in Filebrowser.
It is also not compatible with it’s design philosophy.
At the same time I don’t think it is very difficult to write a module that adds this functionality.
But I am not able to spend any time on it in, now or in the near future.

miguelbraga’s picture

miguelbraga commented

Hi Clive,

I really like this module, simple and effective, I would even like to contribute with my design skills in order to improve icons and CSS.
Recently a client asked me if it would be possible to implement some kind of admin control, in order to avoid unwanted uploads (files with malware, etc).

From my point of view I really don't think this is necessary, because only registered users can upload doc or pdf files.
Unfortunately I'm not a programmer, I'm a designer who's trying to learn more about coding but it's still frustrating because I'm new to Drupal and PHP.

Do you know if there's a way to implement some sort of rules integration?

Thanks for your time,
Miguel

p.s. How much do you think it would cost to hire someone to do this?

clivesj’s picture

clivesj commented

Hello Miguel,
I don't know how your client envision this.
Before you can judge whether you approve a certain uploaded file, this file must be uploaded first to the storage. How do you otherwise know what is uploaded?
You can design an approval system where the administrator will approve the display of the uploaded files.
But the files then are already uploaded. With respect to uploading of malware: the moment the file is on the filesystem the damage is already done.
Unless I don't understand it well I don't see any use of such an approval system.

You can explain your client that there are a few things you can do to provide security for your directory listings:
1. Store your files on in a "private directory" One that is located *outside* of your webroot. This means that the files can not be served by the webbowser. So a malicious file can not be activated by navigating to that file from your browser.
This is the most important mitigation. Files in such a directory can only be served by PHP. They can not be reached by the browser.

2. Restrict uploads to safe file types.
3. Give upload permission only to trusted users,

If you are starting a new project from scratch I would advise you to use the D8 version.

miguelbraga’s picture

miguelbraga commented

Hi Clive,

Thank you very very much for your time, and you described it very well. I'm going to have a meeting with my client tomorrow and I'll explain him precisely what you said.

Thank you again,
Miguel