Can not see the image in the static page "Home" for logged-in users

Bug #1356638 reported by Son Nguyen
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Mahara
Fix Released
High
Robert Lyon

Bug Description

Version: master(1.10), 1.9, 1.8
Platform: any
Browser: any

Steps to reproduce the issue

1. Login as a site admin, add a site image file out of the 'public' folder
2. Add the image into the static page Home (Dashboard)
3. Logout and login as a normal user

Expected result: the image should display in my dashboard
Actual result: the image is not accessible

Aaron Wells (u-aaronw)
Changed in mahara:
milestone: 1.10.0 → 1.10.1
Revision history for this message
Nigel Cunningham (nigelc-g) wrote :

Hi Son.

How did you add the image into the static page? If I copy and paste the URL, it works here with current master.

Revision history for this message
Son Nguyen (ngson2000) wrote :

Hi Nigel,

I added the image by copy/paste its URL.
The key point is the image should not be in the public folder

Revision history for this message
Robert Lyon (robertl-9) wrote :

Ok, the way I see this problem is:

If I add a file to site files in the root dir (not public folder) I can see this image if I add it to a static page (as admin) but if I log in as a non admin I can't see it.

I believe this is related to the site config setting "Access to site files"
 -- "If checked, logged-in users will have access to site files in subfolders. By default, only files in the top level directory are accessible to them."

So it's failing on the check for allowing download of artefact if the artefact is in the site -> files root dir.

It looks to be this line in artefact/file/download.php
        $fileinloggedinmenu = $fileinloggedinmenu && record_exists('site_menu', 'file', $fileid, 'public', 0);

it's only allowing access to site files if they exist in the site_menu

But that doesn't seem in keeping with the statement "By default, only files in the top level directory are accessible to them."

Do we even need the record_exists('site_menu', 'file', $fileid, 'public', 0) bit?

tags: added: behat needs-behat
Aaron Wells (u-aaronw)
no longer affects: mahara/1.9
no longer affects: mahara/1.8
no longer affects: mahara/1.10
no longer affects: mahara/15.04
no longer affects: mahara/15.10
no longer affects: mahara/16.04
Robert Lyon (robertl-9)
Changed in mahara:
milestone: 16.10.1 → 17.04.0
Robert Lyon (robertl-9)
Changed in mahara:
status: Confirmed → In Progress
Changed in mahara:
assignee: Son Nguyen (ngson2000) → nobody
no longer affects: mahara/16.10
Robert Lyon (robertl-9)
Changed in mahara:
status: In Progress → Confirmed
milestone: 17.04.0 → 17.10.0
Revision history for this message
Bob Ridge-Stearn (bobjacqs) wrote :

I posted this in the Support forum on 7 Sept 17 but it did not elicit any response. nevertheless this is an issue for us.

Hi All,
I wonder whether this issue is still affecting people.
I see it was logged as a bug long ago (https://bugs.launchpad.net/mahara/+bug/1356638?comments=all)
The issue is that images on the static Home page (aka Dashboard) do not always appear to logged in users. However, they always appear to logged in users with admin permissions. The issue as we see it seems to be intermittent which makes it difficult to sort out. Sometimes the images will be present, other times they won't. When they do not appear the name of image appears in text form.
We are self hosting and on version 17.04.2 (up to date).
Bob Ridge-Stearn
Newman University, Birmingham UK

Robert Lyon (robertl-9)
Changed in mahara:
importance: Medium → High
status: Confirmed → In Progress
assignee: nobody → Robert Lyon (robertl-9)
Revision history for this message
Mahara Bot (dev-mahara) wrote : A patch has been submitted for review

Patch for "master" branch: https://reviews.mahara.org/8029

Revision history for this message
Robert Lyon (robertl-9) wrote :

For testing:

1) as site admin add images files to Configure site -> Files (not in Public folder)

2) Update the Configure site -> Static pages info for logged in homepage and add an image from 'site files'

3) go to homepage - you should see the image as part of the text

4) login as normal user in 'No institution'

Before patch: no image
After patch: you should see the image as well

5) as institution admin for an institution add images files to Institutions -> Files to that institution (best use different images from before)

6) Update the Institutions -> Static pages info for logged in homepage for same institution as above and add an image from 'institution files'

7) go to homepage - you should see the image as part of the text

8) login as normal user that belongs to that institution

Before patch: no image
After patch: you should see the image as well

Revision history for this message
Niranjan (niranjan528) wrote :

URL :https://bugs.launchpad.net/mahara/+bug/1356638

Bug description:Can not see the image in the static page ‘Home’ for logged-in users.

Environment to be tested: Master
Browser to be tested: Chrome, Firefox, Safari, IE (Latest version)

Precondition:
1. A user ‘Admin’ with ‘Site admin’ privileges should be set up.
2. The institution 'Institution One' should be set up.
3. A normal user ‘User one’ and an institution admin ‘Inst admin’ should be set up.

Steps to reproduce:

1. Login as a ‘Admin’.
2. Navigate to Administration menu > Configure site > Files.
3. Click the ‘Browse’ button and upload an image. Do not add the image to the folder ‘public’.
4. Navigate to Administration menu > Configure site > Static pages.
5. Select ‘Home (Dashboard)’ from the ‘Page name’ drop down.
6. Click the ‘Insert/edit image’ icon from the menu bar under ‘Page text’.
7. Click the ‘Image’ panel.
8. Select the ‘Site files’ tab.
9. Select the image you uploaded in step 3.
10. Click the ‘Save changes’ button.
11. Navigate to the homepage.

Expected result: You should see the image as part of the text, and the text with the image shall not overlap the side blocks or the blocks below the text.

12. Log out of ‘Admin’ user.
13. Login as ‘User one’.

Expected result: You should see the image as part of the text, and the text with the image shall not overlap the side blocks or the blocks below the text.

14. Login as ‘Inst admin’.
15. Navigate to Administration menu > Institutions > Files
16. Click the ‘Browse’ button and upload an image. Make sure the image file is different from step 3.
17. Navigate to Administration menu > Institutions > Static pages.
18. Switch ‘Use site default’ to ‘No’.
19. Click the ‘Insert/edit image’ icon from the menu7 bar under ‘Page text’.
21. Click the ‘Image’ panel.
22. Select the ‘Institution files’ tab.
23. Select one of the image and click the ‘Submit’ button.
24. Click the ‘Save changes’ button.
25. Navigate to the homepage.

Expected result: You should see the image as part of the text, and the text with the image shall not overlap the side blocks or the blocks below the text.

24. Log out as ‘Inst admin’ user.
25. Log in as ‘User one’.

Expected result: You should see the image as part of the text, and the text with the image shall not overlap the side blocks or the blocks below the text.

Revision history for this message
Mahara Bot (dev-mahara) wrote : A change has been merged

Reviewed: https://reviews.mahara.org/8029
Committed: https://git.mahara.org/mahara/mahara/commit/29556c4d29bc866de04fcb159a49f060d404515a
Submitter: Robert Lyon (<email address hidden>)
Branch: master

commit 29556c4d29bc866de04fcb159a49f060d404515a
Author: Robert Lyon <email address hidden>
Date: Tue Sep 19 14:15:17 2017 +1200

Bug 1356638: Allow images to be embedded in static pages

So that they have artefact_file_embedded rows associated with them and
can display to non-admins

behatnotneeded

Change-Id: I477a910637ffc53e0e5be9ed44d0188f49b61bad
Signed-off-by: Robert Lyon <email address hidden>

Robert Lyon (robertl-9)
Changed in mahara:
status: In Progress → Fix Committed
Robert Lyon (robertl-9)
Changed in mahara:
status: Fix Committed → Fix Released
Revision history for this message
Mahara Bot (dev-mahara) wrote : A patch has been submitted for review

Patch for "master" branch: https://reviews.mahara.org/8801

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.