Moodle
  1. Moodle
  2. MDL-34338

Folder resource content not visible for anonymous user (guest access)

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Critical Critical
    • Resolution: Fixed
    • Affects Version/s: 2.3.1, 2.4
    • Fix Version/s: 2.3.3
    • Component/s: Filepicker, Resource
    • Labels:
    • Testing Instructions:
      Hide
      1. Create folder module on the front page and add some image and non-image files in it
      2. Create course accessible to users and add folder in it also with image and non-image files
      3. Log out and attempt to view those modules, make sure all files are displayed and can be downloaded
      Show
      Create folder module on the front page and add some image and non-image files in it Create course accessible to users and add folder in it also with image and non-image files Log out and attempt to view those modules, make sure all files are displayed and can be downloaded
    • Affected Branches:
      MOODLE_23_STABLE, MOODLE_24_STABLE
    • Fixed Branches:
      MOODLE_23_STABLE
    • Pull Master Branch:
      wip-MDL-34338-master

      Description

      In courses where Guest access enrolment method enabled, content of folder resources is not displayed for guest user. However, content of folder is accessible via URL (one can download files when knowing the URL).

      Steps to reproduce:

      1. Create a course and enable Guest access enrolment method
      2. As a teacher, create a Folder resource in the course and upload a file in it
      3. Take note of the direct URL of the uploaded file in the folder resource
      4. Logout
      5. Without logging in, go to the above created course home page and click on the link to the folder resource
      6. Observe that no files are displayed and the folder seems empty
      7. Paste URL (copied previously) in URL browser field
      8. Observe that the file can be downloaded

      Expected behaviour: The folder resource should display all files and subfolders of the folder resource, even for guests

      Actual behaviour: No folder content is displayed and the following error is shown.

      Fatal error: Call to a member function get_url() on a non-object in D:\xampp\htdocs\moodle_testing\mod\folder\renderer.php on line 70

        Gliffy Diagrams

          Issue Links

            Activity

            Hide
            Mary Cooch added a comment -

            Yes I can confirm this on a new install of 2.3

            Show
            Mary Cooch added a comment - Yes I can confirm this on a new install of 2.3
            Hide
            Michael de Raadt added a comment -

            Thanks for reporting that. I was also able to replicate the problem and with debugging on an error was reported.

            I thought this might be related to recent changes in MDL-33746, but this problem appears in 2.3 as well as master.

            Show
            Michael de Raadt added a comment - Thanks for reporting that. I was also able to replicate the problem and with debugging on an error was reported. I thought this might be related to recent changes in MDL-33746 , but this problem appears in 2.3 as well as master.
            Hide
            Petr Skoda added a comment -

            Hi, did you clean your browser cache? The files are cached in your computer, that is why it is normal that you can access them even without login.

            Show
            Petr Skoda added a comment - Hi, did you clean your browser cache? The files are cached in your computer, that is why it is normal that you can access them even without login.
            Hide
            Petr Skoda added a comment -

            Ahh, now I understand - the problem is in access control in file_info_context_module.php - the file browser abstraction is not compatible with guest access. So either somebody has to change it or not use file browser in mod_folder.

            Show
            Petr Skoda added a comment - Ahh, now I understand - the problem is in access control in file_info_context_module.php - the file browser abstraction is not compatible with guest access. So either somebody has to change it or not use file browser in mod_folder.
            Hide
            Dean Montgomery added a comment -

            Same issue here after upgrading to moodle 2.3. Please fix. +1 vote.

            Show
            Dean Montgomery added a comment - Same issue here after upgrading to moodle 2.3. Please fix. +1 vote.
            Hide
            Lindy Klein added a comment -

            We have at least one client reporting this on a new instal of 2.3 as well - gets my +1 for a fix, as it is behavior that users expect (and in some cases, rely on) from 2.2.

            Show
            Lindy Klein added a comment - We have at least one client reporting this on a new instal of 2.3 as well - gets my +1 for a fix, as it is behavior that users expect (and in some cases, rely on) from 2.2.
            Hide
            Tony Hall added a comment -

            I have found what I think is the same issue occurring on the frontpage of our site. We have a couple of folders created in the Main Menu block with documents that Guests should be able to download. When a guest visits the folder it appears to be empty only Authenticated users can see the files.

            Show
            Tony Hall added a comment - I have found what I think is the same issue occurring on the frontpage of our site. We have a couple of folders created in the Main Menu block with documents that Guests should be able to download. When a guest visits the folder it appears to be empty only Authenticated users can see the files.
            Hide
            Emma Richardson added a comment -

            Has anyone found a fix for this? I really need a workaround.

            Show
            Emma Richardson added a comment - Has anyone found a fix for this? I really need a workaround.
            Hide
            Nicolas Martignoni added a comment -

            Any progress yet? I would be happy with any workaround, even temporary, to cope with our angry customers

            Show
            Nicolas Martignoni added a comment - Any progress yet? I would be happy with any workaround, even temporary, to cope with our angry customers
            Hide
            Nicolas Martignoni added a comment -

            This doesn't affect 2.2.x versions.

            Show
            Nicolas Martignoni added a comment - This doesn't affect 2.2.x versions.
            Hide
            Sebastien Michel added a comment -

            I confirm the problem on latest 2.3.1. Guest users can not view the Folders' content.
            This is a serious problem.

            Show
            Sebastien Michel added a comment - I confirm the problem on latest 2.3.1. Guest users can not view the Folders' content. This is a serious problem.
            Hide
            Keith MacAulay added a comment -

            Guests can still access PDFs not contained in a Folder.

            Show
            Keith MacAulay added a comment - Guests can still access PDFs not contained in a Folder.
            Hide
            Sebastien Michel added a comment -

            While waiting for a definitive patch from the core developers, here is a quick fix (at your own risks!). In lib/filebrowser/file_info_context_module.php in get_file_info function

            replace:
            if (!is_viewing($this->context) and !is_enrolled($this->context)) {

            with:
            if (!is_viewing($this->context) and !is_enrolled($this->context) and !is_guest($this->context)) {

            Show
            Sebastien Michel added a comment - While waiting for a definitive patch from the core developers, here is a quick fix (at your own risks!). In lib/filebrowser/file_info_context_module.php in get_file_info function replace: if (!is_viewing($this->context) and !is_enrolled($this->context)) { with: if (!is_viewing($this->context) and !is_enrolled($this->context) and !is_guest($this->context)) {
            Hide
            Emma Richardson added a comment -

            Thank you!!!

            Show
            Emma Richardson added a comment - Thank you!!!
            Hide
            Nicolas Martignoni added a comment - - edited

            Sebastien,

            I confirm that your quick fix works around the regression. However, we'll have to analyse if this doesn't open a security hole.

            In any case, a big thank you for your help.

            Show
            Nicolas Martignoni added a comment - - edited Sebastien, I confirm that your quick fix works around the regression. However, we'll have to analyse if this doesn't open a security hole. In any case, a big thank you for your help.
            Hide
            Nicolas Martignoni added a comment -

            Good news!

            Just tested that with the quick fix, guest still cannot access folder contents in courses where no guest access is allowed.

            Show
            Nicolas Martignoni added a comment - Good news! Just tested that with the quick fix, guest still cannot access folder contents in courses where no guest access is allowed.
            Hide
            Emma Richardson added a comment -

            Yes, I can confirm that too. Hopefully this will get integrated to core.

            Show
            Emma Richardson added a comment - Yes, I can confirm that too. Hopefully this will get integrated to core.
            Hide
            Marina Glancy added a comment -

            Petr, can you peer review this please?
            The error occured because starting from 2.3 I used file_info to display the files in mod_folder nicely but file_info_context_module blocked access for guest users

            Show
            Marina Glancy added a comment - Petr, can you peer review this please? The error occured because starting from 2.3 I used file_info to display the files in mod_folder nicely but file_info_context_module blocked access for guest users
            Hide
            Sebastien Michel added a comment -

            Please note that this bug is not limited to front page Folders but impact all Folders included in Courses opened to guest users (testing instructions are incomplete).

            Show
            Sebastien Michel added a comment - Please note that this bug is not limited to front page Folders but impact all Folders included in Courses opened to guest users (testing instructions are incomplete).
            Hide
            Petr Skoda added a comment -

            I do not understand why is the mod_folder using file_browser abstraction in the first place, it owns the files and can use the file_storage directly without any problems, it also implements the access control for these files - it knows what is and is not allowed which is the same as access to view.php.

            Show
            Petr Skoda added a comment - I do not understand why is the mod_folder using file_browser abstraction in the first place, it owns the files and can use the file_storage directly without any problems, it also implements the access control for these files - it knows what is and is not allowed which is the same as access to view.php.
            Hide
            Dean Montgomery added a comment -

            I have 2 different Moodle 2.3 installs one is an upgrade from 1.9 and the other is a fresh install. The fresh install has no problems with Guests viewing folders. However the moodle upgraded from 1.9 will not allow guests to view folders. I've installed the above mentioned patch and it did not fix it.

            Show
            Dean Montgomery added a comment - I have 2 different Moodle 2.3 installs one is an upgrade from 1.9 and the other is a fresh install. The fresh install has no problems with Guests viewing folders. However the moodle upgraded from 1.9 will not allow guests to view folders. I've installed the above mentioned patch and it did not fix it.
            Hide
            Marina Glancy added a comment -

            Petr, because I need a url of a file which is returned by file_info_stored::get_url(). It is not implemented in class stored_file. Before my changes renderer was using the function file_encode_url() which has comment "TODO deprecate this" and is not flexible enough to allow adding additional parameters (like 'preview=tiny')

            Show
            Marina Glancy added a comment - Petr, because I need a url of a file which is returned by file_info_stored::get_url(). It is not implemented in class stored_file. Before my changes renderer was using the function file_encode_url() which has comment "TODO deprecate this" and is not flexible enough to allow adding additional parameters (like 'preview=tiny')
            Hide
            Petr Skoda added a comment -

            Oh, it should be using factory method moodle_url::make_pluginfile_url() or make_file_url, definitely not file_browser.

            Show
            Petr Skoda added a comment - Oh, it should be using factory method moodle_url::make_pluginfile_url() or make_file_url, definitely not file_browser.
            Hide
            Marina Glancy added a comment -

            Petr thanks,
            I changed the function for file url in mod_folder renderer but still I would like to leave changes in file_info_context_module because we can face this situation again somewhere where file_info is used.

            Show
            Marina Glancy added a comment - Petr thanks, I changed the function for file url in mod_folder renderer but still I would like to leave changes in file_info_context_module because we can face this situation again somewhere where file_info is used.
            Hide
            Jorge Moreira added a comment -

            Hello everyone, i have recently installed a new version of moodle 2.3, and i was having the same problem listing the contents in the folders that are creted in Main Page. So i have changed the code in lib/filebrowser/file_info_context_module.php in get_file_info function as Sebastien said earliar, but the problem is that it only shows the folder contents if the person who visits the moodle clicks in the Enter as Guest. I have tried to copy the file_info_context_module.php from 2.0 version vut doesn´t work, if you could help me i would apreciate that.

            Is some rule in the moodle configuration that makes all the moodle visitors as guest automatically?

            Thanks, i will be waitting for help.

            Jorge Moreira

            Show
            Jorge Moreira added a comment - Hello everyone, i have recently installed a new version of moodle 2.3, and i was having the same problem listing the contents in the folders that are creted in Main Page. So i have changed the code in lib/filebrowser/file_info_context_module.php in get_file_info function as Sebastien said earliar, but the problem is that it only shows the folder contents if the person who visits the moodle clicks in the Enter as Guest. I have tried to copy the file_info_context_module.php from 2.0 version vut doesn´t work, if you could help me i would apreciate that. Is some rule in the moodle configuration that makes all the moodle visitors as guest automatically? Thanks, i will be waitting for help. Jorge Moreira
            Hide
            Jorge Moreira added a comment -

            Sebastien, i have used your code to show the folders content, but only works when the people click in enter as a guest, if you are a simple visitor, without enter as guest it doesn't shows anything , do you know any other solution or correction to the problem? THANKS.

            Show
            Jorge Moreira added a comment - Sebastien, i have used your code to show the folders content, but only works when the people click in enter as a guest, if you are a simple visitor, without enter as guest it doesn't shows anything , do you know any other solution or correction to the problem? THANKS.
            Hide
            Petr Skoda added a comment - - edited

            Marina: implementation of file_broser was never finished, the guest account access was not implemented. I do not like your change there because it duplicates what require_login() is supposed to do, there must be many other nodes in file_info tree that do not support guest access, sorry -1 for the file_browser part, +1 for the mod_folder change. Please create a new issue for the file_browser if necessary - it should imo fix the guest access everywhere with some new method that calls require_login()/require_course_login() inside try catch block.

            Show
            Petr Skoda added a comment - - edited Marina: implementation of file_broser was never finished, the guest account access was not implemented. I do not like your change there because it duplicates what require_login() is supposed to do, there must be many other nodes in file_info tree that do not support guest access, sorry -1 for the file_browser part, +1 for the mod_folder change. Please create a new issue for the file_browser if necessary - it should imo fix the guest access everywhere with some new method that calls require_login()/require_course_login() inside try catch block.
            Hide
            Dean Montgomery added a comment -

            The Diff URL above created by Marina Glancy seems to resolve the guest access problem. Thanks!

            Show
            Dean Montgomery added a comment - The Diff URL above created by Marina Glancy seems to resolve the guest access problem. Thanks!
            Hide
            Didier Raboud added a comment -

            We've a similar issues in which logged in students could not access course folder contents.

            The patch at https://github.com/marinaglancy/moodle/compare/MOODLE_23_STABLE...wip-MDL-34338-MOODLE_23_STABLE worked for us; thanks!

            Show
            Didier Raboud added a comment - We've a similar issues in which logged in students could not access course folder contents. The patch at https://github.com/marinaglancy/moodle/compare/MOODLE_23_STABLE...wip-MDL-34338-MOODLE_23_STABLE worked for us; thanks!
            Hide
            Eloy Lafuente (stronk7) added a comment -

            The main moodle.git repository has just been updated with latest weekly modifications. You may wish to rebase your PULL branches to simplify history and avoid any possible merge conflicts. This would also make integrator's life easier next week.

            TIA and ciao

            Show
            Eloy Lafuente (stronk7) added a comment - The main moodle.git repository has just been updated with latest weekly modifications. You may wish to rebase your PULL branches to simplify history and avoid any possible merge conflicts. This would also make integrator's life easier next week. TIA and ciao
            Hide
            Marina Glancy added a comment -

            Petr, I removed file_info commit and moved it to MDL-35300

            Show
            Marina Glancy added a comment - Petr, I removed file_info commit and moved it to MDL-35300
            Hide
            Eloy Lafuente (stronk7) added a comment -

            Integrated (23 & master), thanks!

            Note: I've added one extra commit taking rid of unused $browser var.

            Show
            Eloy Lafuente (stronk7) added a comment - Integrated (23 & master), thanks! Note: I've added one extra commit taking rid of unused $browser var.
            Hide
            David Monllaó added a comment -

            It passes, tested in master

            Show
            David Monllaó added a comment - It passes, tested in master
            Hide
            Eloy Lafuente (stronk7) added a comment -

            Gutta cavat lapidem, non vi sed saepe cadendo - Ovidio

            This issue has been integrated upstream and is now available both via git and cvs (and in some hours, via mirrors and downloads).

            Thanks!

            Show
            Eloy Lafuente (stronk7) added a comment - Gutta cavat lapidem, non vi sed saepe cadendo - Ovidio This issue has been integrated upstream and is now available both via git and cvs (and in some hours, via mirrors and downloads). Thanks!
            Hide
            Charles Fulton added a comment -

            As a note, this bug also affected viewing folder content when viewing a folder under a different role (say as a site administrator switched to the teacher role). This patch resolved that issue as well.

            Show
            Charles Fulton added a comment - As a note, this bug also affected viewing folder content when viewing a folder under a different role (say as a site administrator switched to the teacher role). This patch resolved that issue as well.
            Hide
            Craig Steenstra added a comment -

            An alternative to this:

            Upload all files (individually or as zipped folder
            Create new Page resource and name it for your folder (e.g. Documents to download)
            Copy and Paste links to files in the Page editor field (could copy all links from folder as they appear on the page)

            Show
            Craig Steenstra added a comment - An alternative to this: Upload all files (individually or as zipped folder Create new Page resource and name it for your folder (e.g. Documents to download) Copy and Paste links to files in the Page editor field (could copy all links from folder as they appear on the page)
            Hide
            Andrej Janzic added a comment -

            Hi,
            Does this links work....
            Where can i find this FIX???

            Show
            Andrej Janzic added a comment - Hi, Does this links work.... Where can i find this FIX???
            Hide
            Marina Glancy added a comment -

            Hi Andrej,
            this link does not show any difference any more because this fix has been integrated in the branches. Latest releases of Moodle 2.3 and 2.4 already contain this fix. If you want to find the particular commit you have to search git log for issue number
            Regard,
            Marina

            Show
            Marina Glancy added a comment - Hi Andrej, this link does not show any difference any more because this fix has been integrated in the branches. Latest releases of Moodle 2.3 and 2.4 already contain this fix. If you want to find the particular commit you have to search git log for issue number Regard, Marina

              People

              • Votes:
                16 Vote for this issue
                Watchers:
                20 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: