Hi!

In my current project, I need to give anonymous users the ability to download some files without giving them access to filedepot. Is it possible to add this "download from filedepot" permission to user access control list so that it can be used to allow downloads even if theres no "access filedepot" permission given or is there maybe some security risk or so?

So basicly, I got two websites, one for file storage with filedepot that isn't really public (though registered users can get there and use filedepot if they want to) and one for a public site that has its own files section, consisting purely of links to filedepot files. Of course, if some filedepot folder has restricted permissions, it will check user rights and allow or deny downloading the file.

My problem is that I don't want to let anonymous users to browse files with filedepot so I don't give "access filedepot" permission to them. In my plan, filedepot browsing is more of a "member user" functionality. I still do have some public folders (like photos) having files that really need to be open for downloads even from anonymous users. I have given these folders the anonymous users access rights from folder permissions, but well of course files can't be downloaded because anonymous users don't have the "access filedepot" permission given.

FYI: I have overridden some of your functions in my own module so I have got this to work. I got no idea though how insecure my solution is but well, my sites are in dev phase so I'm just hoping to see this functionality in final release.

CommentFileSizeAuthor
#9 view_file_depot_files-permission.patch1.97 KBthursday_bw

Comments

blainelang’s picture

blainelang commented

You could use views to present the file listing to anonymous. I am no views expert but was testing this out last week and was able to get views to work and then you could theme it any way you need on the page. I have plans to write up a blog article explaining what I did but basically, created a node-filedepot_folder.tpl.php file in the theme folder and included this code:

    <div class="content">
    
      <h3> <?php echo t('Description'); ?> </h3>
      
        <?php
          echo $node->folderdesc;
          echo theme_filedepot_files($node);
        ?>
   
    </div>

Only files the user has access to should be displayed.

phonkala’s picture

phonkala commented

Maybe we are talking about a different issue here. I especially do NOT want to get any kind of file list or filedepot browser/UI access available for anonymous users (= so no "access filedepot" permission for anonymous in Drupal user permissions), but I do want them still to be able to download files from folders that anonymous users have permissions to in Filedepot folder permissions (and because I don't want them to see file lists, I would have to manually create links to the files so they can be found).

So basicly, I would need either the filedepot folder permissions to overwrite the "access filedepot" permission OR a new permission to Drupal user permissions list. Currently there are "access filedepot", "administer filedepot", "filedepot desktop client" and "filedepot upload" available. What I am after is maybe some "allow filedepot download" that would allow downloading files even if no "access filedepot" permission is given to a certain role.

If someone can explain this better, please do so :)

blainelang’s picture

blainelang commented

If you are over-riding the filedepot_access (HOOK_access) function, you have disabled the main security function and it would now be possible for anyone to download any file. The security is set at the folder or node level. There are multiple other security tests in the application but for download, the module uses the exposed Drupal API's only which rely on HOOK_access.

A new permission like 'hidden download' would need to be added and use a random key as an argument to link to the folder and file so that users (hackers) would not guess and enter random id's to see what they can download.

Not hard to implement but would need to be version 1.1

pbeakley’s picture

pbeakley commented

Has this moved at all recently? I'm building a site that desperately requires that anonymous users be allowed to view files (via the Filedepot Folder node that is created when you create a folder). I tried adding "anonymous user: view" to the folder permissions but obviously that didn't work. Unauthenticated users just get "access denied" when they try to click on the file -- although they CAN see the listed file.

Otherwise great module -- and the Windows client is sweet.

sreedharprabhu.mca@gmail.com’s picture

sreedharprabhu.mca@gmail.com commented

Has this issued is solved?. I mentioned the permission to view and download the files for anonymous user. But still its not showing the folder structure.

Any help is appreciated.

sreedharprabhu.mca@gmail.com’s picture

sreedharprabhu.mca@gmail.com commented
Category: feature » support
Priority: Normal » Critical

Has this issued is solved?. I mentioned the permission to view and download the files for anonymous user. But still its not showing the folder structure.

Any help is appreciated.

blainelang’s picture

blainelang commented

This is not an issue but a feature request. You presently need to grant anonymous users the filedepot access permission to allow these users access to the module. From there it's up to your folder assigned permissions as to what they can see and download.

I noted above that a new feature that could be added is 'hidden download' but that would not allow anonymous users to view anything - only download if given a hidden (tokenized) link.

pbeakley’s picture

pbeakley commented

FYI for anyone who needs this service: The way I ended up implementing this was by generating pages via Views for each file, and then presenting a page with a link to the downloadable file, a title, a description, etc. It's not at all "secure" of course, but the only way to get any kind of security I can think of is to require a login.

I think you could probably jam a randomized hashtag into the URL to thoroughly obscure the link. Haven't done that because it's not that vital to my use case.

thursday_bw’s picture

thursday_bw commented
StatusFileSize
new view_file_depot_files-permission.patch1.97 KB

Here is a patch to acheive this. We had a very similar need ourselves and these are the modifications we made to make it work.

In our situation we wanted only admins to have access to filedepot but authenticated and anonymous users
to still be able to download files.

Simply we created a new permission 'View All File Depot Files' and modify the access permissions on the
download path; Applything the 'View All File Depot Files' permisison to authenticated and anonymous users
gives them the ability to download via filedepot_download/%node/%

sw3b’s picture

sw3b commented

I just test the patch #9 with latest dev for D7 and it solve the problem for me. Could it be possible to take a look for this patch and maybe add/commit to latest DEV ?!?

sw3b’s picture

sw3b commented
Version: 6.x-1.0-rc3 » 7.x-1.x-dev
Issue summary: View changes
Status: Active » Reviewed & tested by the community
thursday_bw’s picture

thursday_bw commented

This has been marked as "Reviewed & tested by the community" for 2 years now.
Can we get this merged please?