Private file can not be published.

Created on 24 November 2023, about 1 year ago
Updated 18 January 2024, 12 months ago

Problem/Motivation

First of all, thanks for this module.
The status of a new media entity created for a private file is 'published' as default. It will remain as published if no changing when creating the new entity.
This module won't move the file from private folder to the public file folder. This causes a confusion where the entity status is published, but actually users who have access to published contents still can't access that file as it is still located in the private file folder.

Steps to reproduce

  1. Enable and configure this module as the installation instructions recommended.
  2. Upload a file to the private folder by other modules, such as the Webform module.
  3. Go to '/admin/content/files' to create a new Media entity for that file by this module.
  4. In the media create form, the status this file is 'published' as default. Leave it as default and save the form.
  5. After creating the new media entity. The file still remains in where it was before (the private folder).
  6. Login out and access that 'published' file URL. Now you will get 403 response.

Proposed resolution

Security-wise, remaining a private file inaccessible is good. That will prevent accidentally publishing a private file via this module.
User experience-wise, it would be better if this module can advise the user or lock down the publish checkbox for a private file.
Another way to avoid a confusion is to move the private file to the public folder if user chose to publish the new media entity. But this move will be more complicated, which will require more thoughts on the existing contents that reference the existing file.

Remaining tasks

Patch to avoid the confusion.

User interface changes

Yes

API changes

No

Data model changes

No

πŸ“Œ Task
Status

Fixed

Version

1.0

Component

Code

Created by

πŸ‡¦πŸ‡ΊAustralia mingsong πŸ‡¦πŸ‡Ί

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024