Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Elfinder file manager: Fix Multi-URL Mode Document Access Issue in Chamilo 1.11.x #5657

Open
wants to merge 1 commit into
base: 1.11.x
Choose a base branch
from

Conversation

juancp-contidosdixitais

Chamilo 1.11.x in multi-url mode has a minor flaw that may allow access to documents from other sessions through the elfinder file manager.

This issue could cause users from sessions from different children sites sharing the same base course view all documents uploaded regardless of the session because elfinder cannot distinguish which session a document belongs to.

Steps to Replicate:

  1. Create a base course and upload Document A.
  2. Create Session 1, add the course to the session, and upload Document B.
  3. Create Session 2, add the course to the session, and upload Document C.

Now, from the elfinder file manager, (any instance of the CKEditor for example), we should only see Documents A and B. However, Documents A, B, and C are visible.

Proposed Mitigation:
This PR implements the following actions to mitigate the issue:

  1. When files are loaded in the file manager, it checks if the files belong to the current session (those that have a session number pattern like "{session_number}" in the name). If they do not belong to the session, the file manager icons are removed.
  2. At the time of attempting to manage any of the files, it verifies if the file belongs to the current session checking the name pattern,. If it does not belong, interactions with the file are not allowed.

ywarnier added a commit to ywarnier/chamilo-lms that referenced this pull request Oct 18, 2024
@ywarnier
Copy link
Member

I believe this is incorrect, as the files may have other context items surrounded by __.
For example, if you use the "Groups" tool inside a course and someone uploads a group document there, you will have something like Comparison__10__11.csv where 10 is the session ID and 11 is the group ID. So your comparison pattern has to be a little more complex...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants