TYPO3 Core

Maybe we can change the behaviour of the ResourceStorage a little so the add permission isn't checked when the file is added through addUploadedFile() as this has it's own permission check.

This may be the planned thing but thats what needs the most changes.

So I'd like to get more information how it was planned to work. And if we can backport it to 6.2 as it would be more or less a breaking change.

I was not involved in the first steps of the FAL project. So I don't know how it was planned to work.

/me too ;-)

Alexander Opitz wrote:

The usage scenario: We want that user can upload a file but they shouldn't have a way to add files on the system (the part under the add folder).

I don't understand this scenario. Can you elaborate? Where should the file end up after upload, when users should not have add permissions?

• Buttons
  • In context menu the upload menu point depends on upload file right.

Can you point me to the place in code where this is the case? I can't find any usage of checking for upload permissions

• In list module the upload button depends on add file rights.

This is correct.

• Upload functionality
  • First upload file rights is checked and then the add file rights. In the write process the add file rights are checked again.

Same here: I can't find a place where upload permissions are checked.

About the buttons I was a bit confused by the ClickMenu disabledItems from

https://github.com/TYPO3/TYPO3.CMS/blob/TYPO3_6-2/typo3/sysext/backend/Classes/ClickMenu/ClickMenu.php#L787

but this differs from

https://github.com/TYPO3/TYPO3.CMS/blob/TYPO3_6-2/typo3/sysext/filelist/Classes/Controller/FileListController.php#L442

where the comment sounds a bit other.

What we like to have is the possibility to upload files but don't have the add file formular in file_newfolder.php

Alexander Opitz wrote:

About the buttons I was a bit confused by the ClickMenu disabledItems from

https://github.com/TYPO3/TYPO3.CMS/blob/TYPO3_6-2/typo3/sysext/backend/Classes/ClickMenu/ClickMenu.php#L787

but this differs from

https://github.com/TYPO3/TYPO3.CMS/blob/TYPO3_6-2/typo3/sysext/filelist/Classes/Controller/FileListController.php#L442

where the comment sounds a bit other.

OK, ClickMenu disabledItems is something completely different and only represents a UI change, not the permission system for FAL.

What is also missing in the click menu is a check for file add permissions on the folder

Alexander Opitz wrote:

What we like to have is the possibility to upload files but don't have the add file formular in file_newfolder.php

You you want to allow uploading of files but prohibit creation of (text) files. Is that correct?

From a security perspective, both are the same. It does not make any difference if I create a file on my local computer and am allowed to upload it or create the same file through a backend UI (without uploading it). Also the result is exactly the same.

To conclude what needs to be fixed:

• Add check folder action permission "add" to ClickMenu
• Remove "upload" permission setting in be_users/be_groups as it is there by accident and does not do anything at all (add file permission is intentionally the one that is evaluated)

Regarding your use case: As far as I understood, this is no FAL permission issue any more, but only a UI customization issue. In that area I won't object any reasonable change. Maybe Felix could make a statement on that.

Helmut Hummel wrote:

Alexander Opitz wrote:

What we like to have is the possibility to upload files but don't have the add file formular in file_newfolder.php

You you want to allow uploading of files but prohibit creation of (text) files. Is that correct?

From a security perspective, both are the same. It does not make any difference if I create a file on my local computer and am allowed to upload it or create the same file through a backend UI (without uploading it). Also the result is exactly the same.

This is not about any security matters, but about disabling what is not needed.
We only want to allow uploading images and pdf files. That was requested by the customer and goes along with setting

$TYPO3_CONF_VARS['BE']['fileExtensions']['webspace']['allow'] = 'png,gif,jpg,jpeg,pdf';
$TYPO3_CONF_VARS['BE']['fileExtensions']['webspace']['deny'] = '*';

For an admin, it may sometimes be necessary to edit text files from the backend, but does the regular editor even know what half of these extensions mean?

Create a new textfile

[*.txt, *.ts, *.html, *.htm, *.css, *.tmpl, *.js, *.sql, *.xml, *.csv, *.xlf]

With the current config you get the input to create a file, but after trying to do so, this message is shown:

Extension of file "bla.txt" was not allowed!

So yes, we really want to get rid of this input for our backend users :)

After discussion, this issue splits in 3 smaller issues:

- Remove the permission settings for the non existing file_upload: #63096
- Fix the "upload" click menu handling
- Build a way to disable the "new file" ui part.

looks like the connected issue was resolved.
Can this issue be closed?

The connected issue was only one part of all, but will discuss with Andreas maybe tomorrow and test if the other parts got already resolved somewhere or is more needed.