Hi there,
I updated from webfm 2.15 ( working ) to 2.18 and found none of my users could download any files.
users can go to the node where the file is attached with no problems but when they click on the file, the get file not found / access denied page.

I even went in and manually set the permissions for some files to "role view download" but still no joy. I also set the default perms to the same

I also checked and the user role has access webfm, view webfm attachments, and webfm upload

I had to back out to 2.15 where its working.

I am running drupal 6.24 I will upload screen shots if that would help.
thanks for your time,
GF

Comments

nhck’s picture

Category: bug » support

Does it work when you are user 1 ?

do you have any other access-limiting modules?

genfoch01’s picture

sorry, yes it does work with user 1 (superuser)
I do have the content access module (6.x-1.2) and I have not made changes to it before or after the upgrade to webfm.

nhck’s picture

Hmm, well because we changed the access model a bit in webfm > 2.15 - so I would suggest you check if there is something set that the users are not allowed to do this?

genfoch01’s picture

Thank you for the response. I have tried admin-> content -> post settings rebuild permissions.
I have set the default permissions in webfm to role, I have made sure the roles have webfm permissions (except webfm admin). I have gone to each file and manually set the permissions to role. I set the file to public download, I tried uploading a new file,

still no joy. I'm at a loss as to what else I can check.

side note: I tried to change the role max upload size and total file size to 0 (blank) as a test. I got an error
which said file size limit must be a number and greater than zero even though the text by the entry says empty or zero means this value is not enforced which implies empty or zero should be a valid entry.

stephaneheller’s picture

I have the same problem here.
It sounds like: #1361200: Roles with permission "view webfm attachments" can view attached files, but no longer actually download them

I do manage 2 Drupal sites on 2 different hosting services and both had the same problem since update to webfm 2.16.
The first went OK with release 2.18, but not the second which still needs 2.16RC1 to run properly.

All tests have been done (with no success) also with user #1

smanes’s picture

I'm having the same problem with 2.18 except that even uid=1 can't view/download the file. I get "Access Denied" and an error dumped in the log:

Type	access denied
Date	Thursday, February 23, 2012 - 12:58am
User	admin
Location	http://xx.xxxxxxx.xxx/webfm_send/3
Referrer	http://xx.xxxxxxx.xxx/webfm
Message	webfm_send/3
Severity	warning

Uploading files and viewing the file list is no problem. It's when I click on the file, such as a JPG image, that I get the error. I get the DHTML popup with the full site in it and an "Access Denied" error message in the content block.

I'm also using Content Access as well as Forum Access and have set WebFM permissions as follows:

Role View Access [checked]
Role Full Access [checked]
Role Attach Access [checked]
Public Access [unchecked]

admin/settings/file-system => Download method = private

I'm not seeing any errors in Apache's error log.

nhck’s picture

What other modules did you all install?
Be aware that access settings in other modules or permissions regarding files in general are now in effect. There was a similar issue were ckeditor prevented that access: #1436442: admin user cannot access webfm_send images.

If you like you can post your list of modules here and I will try to have a look. Expierienced linux users can also do grep -ir '_file_download' sites/ in your drupal root folder. It will give you a list of files that use the hook_file_download and can thus limit access to your file.

I switched webfm to that hook in order to make it more the drupal-way Sorry for causing inconviences.

Thank you.

genfoch01’s picture

ok from grep -ir '_file_download' sites/ i get

./all/modules/filefield/filefield.module
./all/modules/imagefield/imagefield.module
./all/modules/fckeditor/fckeditor.module
./all/modules/backup_migrate/backup_migrate.module
./all/modules/webform/webform.module

do i need to apply the fceditor patch above? (its crossed out, not sure what that means)
do I need to open issues with filefield, imagefield, and backup modules? not trying to be a pain, I just don't understand the implications of these results.

Thanks again for your time.
-GF

nhck’s picture

genfoch01,

>do i need to apply the fceditor patch above? (its crossed out, not sure what that means)
The patch is for ckeditor not fckeditor - two different editors.

As for the module list you provided: There are two possibilites:
1. backup_migrate is strangely configured. You can try to disable that module?
2. Or you are trying to download a file that is also managed by filefield and filefield decides that you cannot access this file. This can happen if the managed file is used in a context that you are not allowed to view. You will see in your permissions page that the fields have their own view permission. If you attached a file via webfm that is also managed by filefield, filefield might deny access to that file.

Basically, everyone, the filepaths are run through the hook_file_download thus imposing access limitations of all modules onto webfm files. The expected behavior which just wasn't implemented by webfm up to now.

nhck’s picture

Status: Active » Closed (cannot reproduce)
nhck’s picture

Apparently there is an error in the backup_migrate.module as per #1496962: upgraded from webfm 2.15 to 2.18 and now have no access to view webfm files

nhck’s picture

Issue summary: View changes

updated for clarity