Option to bypass media access control

Created on 14 September 2023, over 1 year ago
Updated 18 December 2023, about 1 year ago

First, thanks for all the great works on this project.

I use Authlink to generate node link and email them for anonymous access.
But I have to add "View media" permission to anonymous user, otherwise media files won't show in content.

I dont's want anybody have access to the files(without the authlink).
Does it work as design or I am missing something?

Feature request
Status

Closed: won't fix

Version

2.0

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @MarkIII
  • 🇪🇸Spain tunic Madrid

    The problem is described in the Limitations sections in the module page. The problem is this module authorizes access to a single entity, for example a node. However, it doesn't give access to the entities linked from that node. In your case, the module give access to a node but not to the related medias.

    How to fix this? I think is not an easy fix, because that's how the Drupal permissions systems works: visitors needs access to any entity that the user wants to see. And that's ok, is a good approach. This module would need to scan the node and give access to all the related entities. This seems a hard task and also could be a security problem (how deep this process would traverse the relations? Potentially, it can give access to everything).

    I've always used it in sites where the media was public so I didn't face your issue.

  • 🇨🇳China marcolam

    Thank you for your reply, I used this code to auto login user and gain access to media files in a custom module.

                $uid=2;
                $user = User::load($uid);
                $username = $user->getAccountName();
                user_login_finalize($user);
                \Drupal::messenger()->addMessage(t('You are logged in as ' . $username ));
    
  • Status changed to Closed: won't fix about 1 year ago
  • 🇪🇸Spain tunic Madrid

    I'm glad you found a way to achieve what you need, thanks for posting back.

    I'm closing this as "won't fix" because the fix seems hard. However, if anyone has a solution for this that overcomes the issues stated at https://www.drupal.org/project/node_authlink/issues/3387236#comment-1525... Option to bypass media access control Active please reopen this and will discuss the proposed approach.

Production build 0.71.5 2024