I'm using WebFM as a private intranet document managment system. I use a .htaccess file in the WebFM root directory to deny direct file access by typing in the file's URL in a browser. Currently i give privileged roles the "access webfm" permission so they can manage their files, but there is no way to prevent them from making files publicly available.

I want to avoid the possibility that a user might allow files to be downloaded by the public, but still let them use the WebFM file browser to share access to files with other users. There should be a setting to prevent users from granting of the "public download" permission but still allow use of the file browser.

CommentFileSizeAuthor
#4 perms.gif8.6 KBnodecode

Comments

nodecode’s picture

nodecode commented
Title: How to not allow "? » How to not allow "public download" file perms, but still allow file browser use?
cgmonroe’s picture

cgmonroe commented

A quick local fix to do this would be to disable this permission in the putperm ajax command. The code that handles this command is in the webfm.module file, in the webfm_ajax() function. It's the "putperm" case of the command select statement.

FYI - the file permissions are a single integer value that uses a bit mask to indicate if a permission is set or not. These bits are defined in the "file accees bits" constant at about line 24.

The quick way to ensure the public permission is never set is to add the coded needed to set the WEBFM_FILE_ACCESS_PUBLIC_VIEW bit to 0 when ever the putperm command is issued. This can be done to do a bitwise operation with the mask WEBFM_MAX_FILE_ACCESS - WEBFM_FILE_ACCESS_PUBLIC_VIEW.

Here's some untested code that would do this. Note this means people can still select the option... it just won't be stored.

// Validate permission value
if($perm['perm'] >= 0 && $perm['perm'] <= WEBFM_MAX_FILE_ACCESS) {

  $perm = $perm & (WEBFM_MAX_FILE_ACCESS - WEBFM_FILE_ACCESS_PUBLIC_VIEW);

  if(webfm_dbupdate_file($fid, '', $perm)) {

Patches to generalize and make it an admin setting welcome.

nhck’s picture

nhck commented
Version: 6.x-2.12 » 6.x-2.x-dev
Status: Active » Needs work
nodecode’s picture

nodecode commented
StatusFileSize
new perms.gif8.6 KB

I know its been a while but i just got around to testing this code and unfortunately it does not work as coded. I put it in the right place (around line 1278) and it looks like it makes sense to me but i get an error on the file permissions popup: webfm_dbupdate_file() fail regardless of what permissions i try and set (see attached image). Commenting out the code i just put in fixes the issue.

Any idea why this might happen? Is there something i can test?

nodecode’s picture

nodecode commented

is there perhaps some way to disable all permissions controls for webfm users?

nodecode’s picture

nodecode commented

@cgmonroe: Aaaha! I think i figured out what you meant with your air code. Does this look right??

$perm['perm'] = $perm['perm'] & (WEBFM_MAX_FILE_ACCESS - WEBFM_FILE_ACCESS_PUBLIC_VIEW);

So far (after very minor testing) it seems to work as you explained.