Moodle
  1. Moodle
  2. MDL-34338

Folder resource content not visible for anonymous user (guest access)

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Critical Critical
    • Resolution: Fixed
    • Affects Version/s: 2.3.1, 2.4
    • Fix Version/s: 2.3.3
    • Component/s: Filepicker, Resource
    • Labels:
    • Testing Instructions:
      Hide
      1. Create folder module on the front page and add some image and non-image files in it
      2. Create course accessible to users and add folder in it also with image and non-image files
      3. Log out and attempt to view those modules, make sure all files are displayed and can be downloaded
      Show
      Create folder module on the front page and add some image and non-image files in it Create course accessible to users and add folder in it also with image and non-image files Log out and attempt to view those modules, make sure all files are displayed and can be downloaded
    • Affected Branches:
      MOODLE_23_STABLE, MOODLE_24_STABLE
    • Fixed Branches:
      MOODLE_23_STABLE
    • Pull Master Branch:
      wip-MDL-34338-master
    • Rank:
      42708

      Description

      In courses where Guest access enrolment method enabled, content of folder resources is not displayed for guest user. However, content of folder is accessible via URL (one can download files when knowing the URL).

      Steps to reproduce:

      1. Create a course and enable Guest access enrolment method
      2. As a teacher, create a Folder resource in the course and upload a file in it
      3. Take note of the direct URL of the uploaded file in the folder resource
      4. Logout
      5. Without logging in, go to the above created course home page and click on the link to the folder resource
      6. Observe that no files are displayed and the folder seems empty
      7. Paste URL (copied previously) in URL browser field
      8. Observe that the file can be downloaded

      Expected behaviour: The folder resource should display all files and subfolders of the folder resource, even for guests

      Actual behaviour: No folder content is displayed and the following error is shown.

      Fatal error: Call to a member function get_url() on a non-object in D:\xampp\htdocs\moodle_testing\mod\folder\renderer.php on line 70
      

        Issue Links

          Activity

          Hide
          Mary Cooch added a comment -

          Yes I can confirm this on a new install of 2.3

          Show
          Mary Cooch added a comment - Yes I can confirm this on a new install of 2.3
          Hide
          Michael de Raadt added a comment -

          Thanks for reporting that. I was also able to replicate the problem and with debugging on an error was reported.

          I thought this might be related to recent changes in MDL-33746, but this problem appears in 2.3 as well as master.

          Show
          Michael de Raadt added a comment - Thanks for reporting that. I was also able to replicate the problem and with debugging on an error was reported. I thought this might be related to recent changes in MDL-33746 , but this problem appears in 2.3 as well as master.
          Hide
          Petr Škoda added a comment -

          Hi, did you clean your browser cache? The files are cached in your computer, that is why it is normal that you can access them even without login.

          Show
          Petr Škoda added a comment - Hi, did you clean your browser cache? The files are cached in your computer, that is why it is normal that you can access them even without login.
          Hide
          Petr Škoda added a comment -

          Ahh, now I understand - the problem is in access control in file_info_context_module.php - the file browser abstraction is not compatible with guest access. So either somebody has to change it or not use file browser in mod_folder.

          Show
          Petr Škoda added a comment - Ahh, now I understand - the problem is in access control in file_info_context_module.php - the file browser abstraction is not compatible with guest access. So either somebody has to change it or not use file browser in mod_folder.
          Hide
          Dean Montgomery added a comment -

          Same issue here after upgrading to moodle 2.3. Please fix. +1 vote.

          Show
          Dean Montgomery added a comment - Same issue here after upgrading to moodle 2.3. Please fix. +1 vote.
          Hide
          Lindy Klein added a comment -

          We have at least one client reporting this on a new instal of 2.3 as well - gets my +1 for a fix, as it is behavior that users expect (and in some cases, rely on) from 2.2.

          Show
          Lindy Klein added a comment - We have at least one client reporting this on a new instal of 2.3 as well - gets my +1 for a fix, as it is behavior that users expect (and in some cases, rely on) from 2.2.
          Hide
          Tony Hall added a comment -

          I have found what I think is the same issue occurring on the frontpage of our site. We have a couple of folders created in the Main Menu block with documents that Guests should be able to download. When a guest visits the folder it appears to be empty only Authenticated users can see the files.

          Show
          Tony Hall added a comment - I have found what I think is the same issue occurring on the frontpage of our site. We have a couple of folders created in the Main Menu block with documents that Guests should be able to download. When a guest visits the folder it appears to be empty only Authenticated users can see the files.
          Hide
          Emma Richardson added a comment -

          Has anyone found a fix for this? I really need a workaround.

          Show
          Emma Richardson added a comment - Has anyone found a fix for this? I really need a workaround.
          Hide
          Nicolas Martignoni added a comment -

          Any progress yet? I would be happy with any workaround, even temporary, to cope with our angry customers

          Show
          Nicolas Martignoni added a comment - Any progress yet? I would be happy with any workaround, even temporary, to cope with our angry customers
          Hide
          Nicolas Martignoni added a comment -

          This doesn't affect 2.2.x versions.

          Show
          Nicolas Martignoni added a comment - This doesn't affect 2.2.x versions.
          Hide
          Sebastien Michel added a comment -

          I confirm the problem on latest 2.3.1. Guest users can not view the Folders' content.
          This is a serious problem.

          Show
          Sebastien Michel added a comment - I confirm the problem on latest 2.3.1. Guest users can not view the Folders' content. This is a serious problem.
          Hide
          Keith MacAulay added a comment -

          Guests can still access PDFs not contained in a Folder.

          Show
          Keith MacAulay added a comment - Guests can still access PDFs not contained in a Folder.
          Hide
          Sebastien Michel added a comment -

          While waiting for a definitive patch from the core developers, here is a quick fix (at your own risks!). In lib/filebrowser/file_info_context_module.php in get_file_info function

          replace:
          if (!is_viewing($this->context) and !is_enrolled($this->context)) {

          with:
          if (!is_viewing($this->context) and !is_enrolled($this->context) and !is_guest($this->context)) {

          Show
          Sebastien Michel added a comment - While waiting for a definitive patch from the core developers, here is a quick fix (at your own risks!). In lib/filebrowser/file_info_context_module.php in get_file_info function replace: if (!is_viewing($this->context) and !is_enrolled($this->context)) { with: if (!is_viewing($this->context) and !is_enrolled($this->context) and !is_guest($this->context)) {
          Hide
          Emma Richardson added a comment -

          Thank you!!!

          Show
          Emma Richardson added a comment - Thank you!!!
          Hide
          Nicolas Martignoni added a comment - - edited

          Sebastien,

          I confirm that your quick fix works around the regression. However, we'll have to analyse if this doesn't open a security hole.

          In any case, a big thank you for your help.

          Show
          Nicolas Martignoni added a comment - - edited Sebastien, I confirm that your quick fix works around the regression. However, we'll have to analyse if this doesn't open a security hole. In any case, a big thank you for your help.
          Hide
          Nicolas Martignoni added a comment -

          Good news!

          Just tested that with the quick fix, guest still cannot access folder contents in courses where no guest access is allowed.

          Show
          Nicolas Martignoni added a comment - Good news! Just tested that with the quick fix, guest still cannot access folder contents in courses where no guest access is allowed.
          Hide
          Emma Richardson added a comment -

          Yes, I can confirm that too. Hopefully this will get integrated to core.

          Show
          Emma Richardson added a comment - Yes, I can confirm that too. Hopefully this will get integrated to core.
          Hide
          Marina Glancy added a comment -

          Petr, can you peer review this please?
          The error occured because starting from 2.3 I used file_info to display the files in mod_folder nicely but file_info_context_module blocked access for guest users

          Show
          Marina Glancy added a comment - Petr, can you peer review this please? The error occured because starting from 2.3 I used file_info to display the files in mod_folder nicely but file_info_context_module blocked access for guest users
          Hide
          Sebastien Michel added a comment -

          Please note that this bug is not limited to front page Folders but impact all Folders included in Courses opened to guest users (testing instructions are incomplete).

          Show
          Sebastien Michel added a comment - Please note that this bug is not limited to front page Folders but impact all Folders included in Courses opened to guest users (testing instructions are incomplete).
          Hide
          Petr Škoda added a comment -

          I do not understand why is the mod_folder using file_browser abstraction in the first place, it owns the files and can use the file_storage directly without any problems, it also implements the access control for these files - it knows what is and is not allowed which is the same as access to view.php.

          Show
          Petr Škoda added a comment - I do not understand why is the mod_folder using file_browser abstraction in the first place, it owns the files and can use the file_storage directly without any problems, it also implements the access control for these files - it knows what is and is not allowed which is the same as access to view.php.
          Hide
          Dean Montgomery added a comment -

          I have 2 different Moodle 2.3 installs one is an upgrade from 1.9 and the other is a fresh install. The fresh install has no problems with Guests viewing folders. However the moodle upgraded from 1.9 will not allow guests to view folders. I've installed the above mentioned patch and it did not fix it.

          Show
          Dean Montgomery added a comment - I have 2 different Moodle 2.3 installs one is an upgrade from 1.9 and the other is a fresh install. The fresh install has no problems with Guests viewing folders. However the moodle upgraded from 1.9 will not allow guests to view folders. I've installed the above mentioned patch and it did not fix it.
          Hide
          Marina Glancy added a comment -

          Petr, because I need a url of a file which is returned by file_info_stored::get_url(). It is not implemented in class stored_file. Before my changes renderer was using the function file_encode_url() which has comment "TODO deprecate this" and is not flexible enough to allow adding additional parameters (like 'preview=tiny')

          Show
          Marina Glancy added a comment - Petr, because I need a url of a file which is returned by file_info_stored::get_url(). It is not implemented in class stored_file. Before my changes renderer was using the function file_encode_url() which has comment "TODO deprecate this" and is not flexible enough to allow adding additional parameters (like 'preview=tiny')
          Hide
          Petr Škoda added a comment -

          Oh, it should be using factory method moodle_url::make_pluginfile_url() or make_file_url, definitely not file_browser.

          Show
          Petr Škoda added a comment - Oh, it should be using factory method moodle_url::make_pluginfile_url() or make_file_url, definitely not file_browser.
          Hide
          Marina Glancy added a comment -

          Petr thanks,
          I changed the function for file url in mod_folder renderer but still I would like to leave changes in file_info_context_module because we can face this situation again somewhere where file_info is used.

          Show
          Marina Glancy added a comment - Petr thanks, I changed the function for file url in mod_folder renderer but still I would like to leave changes in file_info_context_module because we can face this situation again somewhere where file_info is used.
          Hide
          Jorge Moreira added a comment -

          Hello everyone, i have recently installed a new version of moodle 2.3, and i was having the same problem listing the contents in the folders that are creted in Main Page. So i have changed the code in lib/filebrowser/file_info_context_module.php in get_file_info function as Sebastien said earliar, but the problem is that it only shows the folder contents if the person who visits the moodle clicks in the Enter as Guest. I have tried to copy the file_info_context_module.php from 2.0 version vut doesn´t work, if you could help me i would apreciate that.

          Is some rule in the moodle configuration that makes all the moodle visitors as guest automatically?

          Thanks, i will be waitting for help.

          Jorge Moreira

          Show
          Jorge Moreira added a comment - Hello everyone, i have recently installed a new version of moodle 2.3, and i was having the same problem listing the contents in the folders that are creted in Main Page. So i have changed the code in lib/filebrowser/file_info_context_module.php in get_file_info function as Sebastien said earliar, but the problem is that it only shows the folder contents if the person who visits the moodle clicks in the Enter as Guest. I have tried to copy the file_info_context_module.php from 2.0 version vut doesn´t work, if you could help me i would apreciate that. Is some rule in the moodle configuration that makes all the moodle visitors as guest automatically? Thanks, i will be waitting for help. Jorge Moreira
          Hide
          Jorge Moreira added a comment -

          Sebastien, i have used your code to show the folders content, but only works when the people click in enter as a guest, if you are a simple visitor, without enter as guest it doesn't shows anything , do you know any other solution or correction to the problem? THANKS.

          Show
          Jorge Moreira added a comment - Sebastien, i have used your code to show the folders content, but only works when the people click in enter as a guest, if you are a simple visitor, without enter as guest it doesn't shows anything , do you know any other solution or correction to the problem? THANKS.
          Hide
          Petr Škoda added a comment - - edited

          Marina: implementation of file_broser was never finished, the guest account access was not implemented. I do not like your change there because it duplicates what require_login() is supposed to do, there must be many other nodes in file_info tree that do not support guest access, sorry -1 for the file_browser part, +1 for the mod_folder change. Please create a new issue for the file_browser if necessary - it should imo fix the guest access everywhere with some new method that calls require_login()/require_course_login() inside try catch block.

          Show
          Petr Škoda added a comment - - edited Marina: implementation of file_broser was never finished, the guest account access was not implemented. I do not like your change there because it duplicates what require_login() is supposed to do, there must be many other nodes in file_info tree that do not support guest access, sorry -1 for the file_browser part, +1 for the mod_folder change. Please create a new issue for the file_browser if necessary - it should imo fix the guest access everywhere with some new method that calls require_login()/require_course_login() inside try catch block.
          Hide
          Dean Montgomery added a comment -

          The Diff URL above created by Marina Glancy seems to resolve the guest access problem. Thanks!

          Show
          Dean Montgomery added a comment - The Diff URL above created by Marina Glancy seems to resolve the guest access problem. Thanks!
          Hide
          Didier Raboud added a comment -

          We've a similar issues in which logged in students could not access course folder contents.

          The patch at https://github.com/marinaglancy/moodle/compare/MOODLE_23_STABLE...wip-MDL-34338-MOODLE_23_STABLE worked for us; thanks!

          Show
          Didier Raboud added a comment - We've a similar issues in which logged in students could not access course folder contents. The patch at https://github.com/marinaglancy/moodle/compare/MOODLE_23_STABLE...wip-MDL-34338-MOODLE_23_STABLE worked for us; thanks!
          Hide
          Eloy Lafuente (stronk7) added a comment -

          The main moodle.git repository has just been updated with latest weekly modifications. You may wish to rebase your PULL branches to simplify history and avoid any possible merge conflicts. This would also make integrator's life easier next week.

          TIA and ciao

          Show
          Eloy Lafuente (stronk7) added a comment - The main moodle.git repository has just been updated with latest weekly modifications. You may wish to rebase your PULL branches to simplify history and avoid any possible merge conflicts. This would also make integrator's life easier next week. TIA and ciao
          Hide
          Marina Glancy added a comment -

          Petr, I removed file_info commit and moved it to MDL-35300

          Show
          Marina Glancy added a comment - Petr, I removed file_info commit and moved it to MDL-35300
          Hide
          Eloy Lafuente (stronk7) added a comment -

          Integrated (23 & master), thanks!

          Note: I've added one extra commit taking rid of unused $browser var.

          Show
          Eloy Lafuente (stronk7) added a comment - Integrated (23 & master), thanks! Note: I've added one extra commit taking rid of unused $browser var.
          Hide
          David Monllaó added a comment -

          It passes, tested in master

          Show
          David Monllaó added a comment - It passes, tested in master
          Hide
          Eloy Lafuente (stronk7) added a comment -

          Gutta cavat lapidem, non vi sed saepe cadendo - Ovidio

          This issue has been integrated upstream and is now available both via git and cvs (and in some hours, via mirrors and downloads).

          Thanks!

          Show
          Eloy Lafuente (stronk7) added a comment - Gutta cavat lapidem, non vi sed saepe cadendo - Ovidio This issue has been integrated upstream and is now available both via git and cvs (and in some hours, via mirrors and downloads). Thanks!
          Hide
          Charles Fulton added a comment -

          As a note, this bug also affected viewing folder content when viewing a folder under a different role (say as a site administrator switched to the teacher role). This patch resolved that issue as well.

          Show
          Charles Fulton added a comment - As a note, this bug also affected viewing folder content when viewing a folder under a different role (say as a site administrator switched to the teacher role). This patch resolved that issue as well.
          Hide
          Craig Steenstra added a comment -

          An alternative to this:

          Upload all files (individually or as zipped folder
          Create new Page resource and name it for your folder (e.g. Documents to download)
          Copy and Paste links to files in the Page editor field (could copy all links from folder as they appear on the page)

          Show
          Craig Steenstra added a comment - An alternative to this: Upload all files (individually or as zipped folder Create new Page resource and name it for your folder (e.g. Documents to download) Copy and Paste links to files in the Page editor field (could copy all links from folder as they appear on the page)
          Hide
          Andrej Janzic added a comment -

          Hi,
          Does this links work....
          Where can i find this FIX???

          Show
          Andrej Janzic added a comment - Hi, Does this links work.... Where can i find this FIX???
          Hide
          Marina Glancy added a comment -

          Hi Andrej,
          this link does not show any difference any more because this fix has been integrated in the branches. Latest releases of Moodle 2.3 and 2.4 already contain this fix. If you want to find the particular commit you have to search git log for issue number
          Regard,
          Marina

          Show
          Marina Glancy added a comment - Hi Andrej, this link does not show any difference any more because this fix has been integrated in the branches. Latest releases of Moodle 2.3 and 2.4 already contain this fix. If you want to find the particular commit you have to search git log for issue number Regard, Marina

            People

            • Votes:
              16 Vote for this issue
              Watchers:
              20 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: