Forum OpenACS Development: Permission discrepancy in file-storage

Here are more details about Derick's question,

When you use the button for bulk actions, the script is:

    server/file-storage/www/delete.tcl

and the code which determines if the user has proper permissions is the following sql (oracle's is similar):

        select fs.object_id as fs_object_id, fs.type, fs.name, fs.parent_id,
        acs_permission__permission_p(fs.object_id, :user_id, 'write') as delete_p
        from fs_objects fs
        where fs.object_id in ('$object_id_list')

On the other hand, if you go through the file properties page and delete a file, the requested script is

   server/file-storage/www/file-delete.tcl

and the corresponding checking code is

        ad_require_permission $file_id delete

Additionally, the following comment appears in the move.tcl and delete.tcl file

# DaveB: I think it should be DELETE instead of WRITEs:

Checking the now deleted file-move.tcl and the original (outdated?) design documentation of the package, it seems the use of the "write" permission to move/delete comes from a previous unix-like permission approach.

Snippet from file-move.tcl:

# check they have write permission on the file (is this really the
# right permission?)
ad_require_permission $file_id write


I can provide the patch or commit it to HEAD to fix the delete and move scripts.

Hi Eduardo,

I hadn't realized this was already submitted in the bugtracker, sorry about that.

I submitted my patch in the bug report as well, it's basically the same but checking for the "delete" privilege instead of "admin", in case there's any explicit permission. I also changed this for the "move" process.