Private files access in Drupal 7 versus Drupal 6 with mm_media

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Private files access in Drupal 7 versus Drupal 6 with mm_media

McBride, Ian S.
I had thought that I had this issue resolved, but it's cropped up again in working on transferring one of our sites. In Drupal 6 right now we have the "download method" setting in /admin/settings/file-system set to Private, but D6 only has a single file system path, so all our mm_media managed files are stored in sites/www.site.edu/files.

When a mm_media node is rendered on the page in Drupal 6, the image is printed like this:

<img width="300" height="200" class="image standard" title="Title" alt="Alt" src="/media/view/123456/standard/image.jpg">

So access to the image goes through the menu hook in the mm_media module that looks at /media/view and checks the node access based on the nid.

However, in Drupal 7, there's a separate private files directory, so we have sites/www.site.edu/files/private/media where we'd like to transfer the files from the Drupal 6 site so that they can't be accessed directly without passing through mm_media_file_download().

The same mm_media node in Drupal 7 renders the image like this:

<img width="300" height="200" class="image standard" title="Title" alt="Alt" src="/system/files/media/image.jpg">

I believe that this passes through mm_media_file_download() and the node is on a publicly readable page, but the image file won't appear unless I'm logged in to the site as an admin. It won't even appear if I give anonymous users "View private files" access, which I'd prefer not to do - I'd like to continue to let Monster Menus handle this.

The only permission that I'm giving anonymous users under File entity right now is "View files". Are there others that I'm missing?
---
You are currently subscribed to monster_menus as: [hidden email].
To unsubscribe click here: http://lists.middlebury.edu/u?id=685503.6b071f880fe6a965a128164e6d09ea81&n=T&l=monster_menus&o=704389
or send a blank email to [hidden email]
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Private files access in Drupal 7 versus Drupal 6 with mm_media

McBride, Ian S.
An update on this: somewhere in the Drupal 6 to Drupal 7 upgrade process when the file_managed table gets created the fids in the webform_submitted_data table don't get updated to their new values and remain tied to the indices in the old files table. This means that some random assortment of files are now associated with random webform submissions and, since we don't want to show webform submissions publicly, they now appear hidden to non-admin users.

This is probably happening because my upgrade script runs the database updates for the webform module before the updates for the media module because of the way that I have to swap that in and out of place to handle the renaming of mm_media, which is to say that this is an issue that should only ever affect us at Middlebury. Sorry for pestering the list about this!

From: <McBride>, Ian McBride <[hidden email]<mailto:[hidden email]>>
Date: Monday, July 21, 2014 at 4:28 PM
To: Monster Menus Development <[hidden email]<mailto:[hidden email]>>
Subject: RE: Private files access in Drupal 7 versus Drupal 6 with mm_media

Here's a weird update on this. The file only fails to appear some of the time, and as far as I can tell there is no difference between the files in the database or on the file system.

file_managed:

fid     uid     filename        uri     filemime        filesize        status  timestamp       type
3795    8       satomi_kobayashi.jpg    private://media/satomi_kobayashi.jpg    image/jpeg      79025   1       1405950646      image
4365    5059    jason.statedept.conference.2014.sm2_.jpg        private://media/jason.statedept.conference.2014.sm2_.jpg        image/jpeg      43004   1       1405950646      image

file_usage:

fid     module  type    id      count
3795    mm_media        node    37565   1
4365    mm_media        node    37555   1

mm_media_files:

mfid    nid     vid     filename        uri     filemime        filesize        uploadedfilename        fileattribs
73980   37555   194727  original        private://media/jason.statedept.conference.2014.sm2_.jpg        image/jpeg      43004   jason.statedept.conference.2014.sm2_.jpg        NULL
73984   37565   194758  original        private://media/satomi_kobayashi.jpg    image/jpeg      79025   satomi_kobayashi.jpg    NULL

node:

nid     vid     type    language        title   uid     status  created changed comment promote sticky  tnid    translate
37555   194777  mm_media        und     "Our Ocean 2014" State Department Conference    5059    1       1405564745      1405630043      0       0       0       0       0
37565   194758  mm_media        und     Satomi%20Kobayashi      8       1       1405623039      1405623039      0       0       0       0       0

Are there other tables I should be looking at to figure out why one file might be accessible and the other not?
________________________________________
From: McBride, Ian S. [[hidden email]<mailto:[hidden email]>]
Sent: Monday, July 21, 2014 3:24 PM
To: Monster Menus Development
Subject: Private files access in Drupal 7 versus Drupal 6 with mm_media

I had thought that I had this issue resolved, but it's cropped up again in working on transferring one of our sites. In Drupal 6 right now we have the "download method" setting in /admin/settings/file-system set to Private, but D6 only has a single file system path, so all our mm_media managed files are stored in sites/www.site.edu/files.

When a mm_media node is rendered on the page in Drupal 6, the image is printed like this:

<img width="300" height="200" class="image standard" title="Title" alt="Alt" src="/media/view/123456/standard/image.jpg">

So access to the image goes through the menu hook in the mm_media module that looks at /media/view and checks the node access based on the nid.

However, in Drupal 7, there's a separate private files directory, so we have sites/www.site.edu/files/private/media where we'd like to transfer the files from the Drupal 6 site so that they can't be accessed directly without passing through mm_media_file_download().

The same mm_media node in Drupal 7 renders the image like this:

<img width="300" height="200" class="image standard" title="Title" alt="Alt" src="/system/files/media/image.jpg">

I believe that this passes through mm_media_file_download() and the node is on a publicly readable page, but the image file won't appear unless I'm logged in to the site as an admin. It won't even appear if I give anonymous users "View private files" access, which I'd prefer not to do - I'd like to continue to let Monster Menus handle this.

The only permission that I'm giving anonymous users under File entity right now is "View files". Are there others that I'm missing?
---
You are currently subscribed to monster_menus as: [hidden email]<mailto:[hidden email]>.
To unsubscribe click here: http://lists.middlebury.edu/u?id=685439.7e7cbccf9bb225cf8471bffe1cb67503&n=T&l=monster_menus&o=704389
or send a blank email to [hidden email]<mailto:[hidden email]>

---
You are currently subscribed to monster_menus as: [hidden email].
To unsubscribe click here: http://lists.middlebury.edu/u?id=685503.6b071f880fe6a965a128164e6d09ea81&n=T&l=monster_menus&o=704427
or send a blank email to [hidden email]
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Private files access in Drupal 7 versus Drupal 6 with mm_media

McBride, Ian S.
In reply to this post by McBride, Ian S.
As a further follow-up, it appears that this is a known issue with the
webform module: https://www.drupal.org/node/1881668

I had to modify their script a little bit and am not 100% certain that all
of the webform files got re-mapped correctly (particularly those where the
same file with the same fid appears in multiple submissions), but the
images and files I was using to test now appear to be working.

On 7/22/14, 2:59 PM, "McBride, Ian S." <[hidden email]> wrote:

>An update on this: somewhere in the Drupal 6 to Drupal 7 upgrade process
>when the file_managed table gets created the fids in the
>webform_submitted_data table don't get updated to their new values and
>remain tied to the indices in the old files table. This means that some
>random assortment of files are now associated with random webform
>submissions and, since we don't want to show webform submissions
>publicly, they now appear hidden to non-admin users.
>
>This is probably happening because my upgrade script runs the database
>updates for the webform module before the updates for the media module
>because of the way that I have to swap that in and out of place to handle
>the renaming of mm_media, which is to say that this is an issue that
>should only ever affect us at Middlebury. Sorry for pestering the list
>about this!
>
>From: <McBride>, Ian McBride
><[hidden email]<mailto:[hidden email]>>
>Date: Monday, July 21, 2014 at 4:28 PM
>To: Monster Menus Development
><[hidden email]<mailto:[hidden email].
>edu>>
>Subject: RE: Private files access in Drupal 7 versus Drupal 6 with
>mm_media
>
>Here's a weird update on this. The file only fails to appear some of the
>time, and as far as I can tell there is no difference between the files
>in the database or on the file system.
>
>file_managed:
>
>fid     uid     filename        uri     filemime        filesize
>status  timestamp       type
>3795    8       satomi_kobayashi.jpg
>private://media/satomi_kobayashi.jpg    image/jpeg      79025   1
>1405950646      image
>4365    5059    jason.statedept.conference.2014.sm2_.jpg
>private://media/jason.statedept.conference.2014.sm2_.jpg
>image/jpeg      43004   1       1405950646      image
>
>file_usage:
>
>fid     module  type    id      count
>3795    mm_media        node    37565   1
>4365    mm_media        node    37555   1
>
>mm_media_files:
>
>mfid    nid     vid     filename        uri     filemime        filesize
>      uploadedfilename        fileattribs
>73980   37555   194727  original
>private://media/jason.statedept.conference.2014.sm2_.jpg
>image/jpeg      43004   jason.statedept.conference.2014.sm2_.jpg
>NULL
>73984   37565   194758  original
>private://media/satomi_kobayashi.jpg    image/jpeg      79025
>satomi_kobayashi.jpg    NULL
>
>node:
>
>nid     vid     type    language        title   uid     status  created
>changed comment promote sticky  tnid    translate
>37555   194777  mm_media        und     "Our Ocean 2014" State Department
>Conference    5059    1       1405564745      1405630043      0       0
>    0       0       0
>37565   194758  mm_media        und     Satomi%20Kobayashi      8       1
>      1405623039      1405623039      0       0       0       0       0
>
>Are there other tables I should be looking at to figure out why one file
>might be accessible and the other not?
>________________________________________
>From: McBride, Ian S.
>[[hidden email]<mailto:[hidden email]>]
>Sent: Monday, July 21, 2014 3:24 PM
>To: Monster Menus Development
>Subject: Private files access in Drupal 7 versus Drupal 6 with mm_media
>
>I had thought that I had this issue resolved, but it's cropped up again
>in working on transferring one of our sites. In Drupal 6 right now we
>have the "download method" setting in /admin/settings/file-system set to
>Private, but D6 only has a single file system path, so all our mm_media
>managed files are stored in sites/www.site.edu/files.
>
>When a mm_media node is rendered on the page in Drupal 6, the image is
>printed like this:
>
><img width="300" height="200" class="image standard" title="Title"
>alt="Alt" src="/media/view/123456/standard/image.jpg">
>
>So access to the image goes through the menu hook in the mm_media module
>that looks at /media/view and checks the node access based on the nid.
>
>However, in Drupal 7, there's a separate private files directory, so we
>have sites/www.site.edu/files/private/media where we'd like to transfer
>the files from the Drupal 6 site so that they can't be accessed directly
>without passing through mm_media_file_download().
>
>The same mm_media node in Drupal 7 renders the image like this:
>
><img width="300" height="200" class="image standard" title="Title"
>alt="Alt" src="/system/files/media/image.jpg">
>
>I believe that this passes through mm_media_file_download() and the node
>is on a publicly readable page, but the image file won't appear unless
>I'm logged in to the site as an admin. It won't even appear if I give
>anonymous users "View private files" access, which I'd prefer not to do -
>I'd like to continue to let Monster Menus handle this.
>
>The only permission that I'm giving anonymous users under File entity
>right now is "View files". Are there others that I'm missing?
>---
>You are currently subscribed to monster_menus as:
>[hidden email]<mailto:[hidden email]>.
>To unsubscribe click here:
>http://lists.middlebury.edu/u?id=685439.7e7cbccf9bb225cf8471bffe1cb67503&n
>=T&l=monster_menus&o=704389
>or send a blank email to
>[hidden email]<
>mailto:[hidden email]
>ry.edu>
>
>---
>You are currently subscribed to monster_menus as: [hidden email].
>To unsubscribe click here:
>http://lists.middlebury.edu/u?id=685439.7e7cbccf9bb225cf8471bffe1cb67503&n
>=T&l=monster_menus&o=704427
>or send a blank email to
>[hidden email]


---
You are currently subscribed to monster_menus as: [hidden email].
To unsubscribe click here: http://lists.middlebury.edu/u?id=685503.6b071f880fe6a965a128164e6d09ea81&n=T&l=monster_menus&o=704439
or send a blank email to [hidden email]
Loading...