Internal assets cannot be seen by non-admin users
Kota-M opened this issue · 3 comments
I have been implementing some features on my site with Craft 3 and internal asset plugin.
Then, I would like to have some private assets, so I made a folder "internal" out of webroot.
Assets which should be private are in that folder.
However, those assets cannot be seen by non-admin users.
As you can see in attached screenshot, the asset is set on the field for admin, but not for non-admin user.
FYI, the asset appears in "Asset" tab.
So, I was wondering if you could help me to solve this issue.
The version of internal asset plugin is 2.3.1. I suppose it is the latest version.
I have read the issue #15, but that code fix had already been applied.
Dear @Kota-M
Thank you for reporting this. I need to look into the problem. Sorry for the inconvenience, we are currently not using craft anymore for our website – which is to bad, since it's an awesome system – and therefore I do not encounter such issues myself any more.
The problem might be due to the implementation of the permission check. The plugin implements a custom volume source and access to the content is checked in src/controllers/DefaultController.php in "actionFetch", which also allows for public access. Maybe access to assets from the control panel use a different method of accessing assets.
Good afternoon. I am still looking for the solution for this issue. Could I ask have you found something?
This issue should no longer occur in the new Craft 4 version of the plugin.