FileManager 19.3.44 Access Rule for "Write" doesn't work when IsFile is set true
Hi~
I am testing a scenario where different role have different access permissions for files and folders. I have set two roles, one is admin which can read or write all the files and folders, the other is default which only can read. In fact, in practical application，when I choose the role of default, I also can rename or delete any files ,but this is shouldn't happened because I have set the Access Rule for "Write" to Permission.Deny.
The following is my code, could you please comfirm this is a bug or there is any error in my code ?
Thanks!
Attachment: FileManager_364d3b18.rar
update 1
when I choose the role of default, I can also download any files although I have set the Access Rule for "Download" to Permission.Deny.
Is there a problem with the way I specified the path?
|
// Access Rules for folder available in root folder
new AccessRule { Path = "/*.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny},
//Access Rules for files available in root folder
new AccessRule { Path = "/*.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny, IsFile=true}, |
Hi Indhumathy, thanks your help,
If I specified the Path with "/*.*", it really work for the Access Rule of "Write" and "Download". But if I specified the Path with "/Documents.*" or "/Pictures.*", it dosen't work. The code likes the following:
new AccessRule { Path = "/Documents.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny},
new AccessRule { Path = "/Documents.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny, IsFile=true},
new AccessRule { Path = "/Pictures.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny},
new AccessRule { Path = "/Pictures.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny, IsFile=true},
In adddition, In my usage scenarios , I want to set the role different permission for different child folder of root folder. And my root folder is showed in the attachment.
Attachment: Files_92609f38.rar
|
//Access Rules for Documents folder.
new AccessRule { Path = "/Documents.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny},
//Access Rules all the files inside Documents folder.
new AccessRule { Path = "/Documents/*.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny, IsFile=true},
//Access Rules for Pictures folder.
new AccessRule { Path = "/Pictures.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny},
//Access Rules all the files inside Pictures folder.
new AccessRule { Path = "/Pictures/*.*", Role = "default", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, WriteContents = Permission.Deny, Upload = Permission.Deny, Download = Permission.Deny, IsFile=true}, |
|
// Deny writing for particular file
new AccessRule { Path = "/Documents/2.png", Role = "Document Manager", Read = Permission.Allow, Write = Permission.Deny, Copy = Permission.Deny, Download = Permission.Deny, IsFile = true }, |
Hi Indhumathy，
I thank you for your comprehensive answer. It really have solved my problem.
Thank you.
Hello,
The provided code can lead to potential bug because of the use of a STATIC variable to store Roles =>
public static string roleName
Let me explain that if you have 2 pages that have each a filemanager component OR even 1 page that embbeds 2 or more filemanager component, then the code you've provided is wrong because of STATIC that retains previous values, kinda practical at 1st sight but not useable in a production stage.
A really annoying problem.
Another reall annoying problem is that you can't use HttpClient (with credentials you've settled) from your controller : common scenario is : 1 api server (net core) and 1 client (in wasm for example), then to access to your server's controllers you generally use HttpClient calls, this very client contains CLAIMS and all the bells required for any [Authorized] and so on... that you can't use because the HttpClient is not supported through all example i've seen onto examples/support as well. This last point is really annoying for security concerns, because you de facto allow anyone to access to this controller freely...
It would really nice to have HttpClient support, else we loose Claims and al...
Regards
Hi Gerome,
Thank you for your sincere reminder!
Regards
- 9 Replies
- 4 Participants
-
OU OuYuanbin
- Oct 12, 2021 07:35 AM UTC
- Oct 19, 2021 02:39 PM UTC
