Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-49426

If my private files is disabled, there is no way for uploading files via Web Services

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 2.7.5, 2.8.3
    • Fix Version/s: 2.7.8, 2.8.6, 2.9
    • Component/s: Web Services
    • Labels:
    • Testing Instructions:
      Hide
      1. As admin: enable "Mobile services": Plugins ► Web Services ► Mobile
      2. Create a Token for the student user
        • Click on Site administration ► Plugins ► Web services ► Manage tokens
      3. Edit the Authenticated User system Role, disable the moodle/user:manageownfiles capabilities
      4. Try to upload an existing file to your private file area using curl:
        • Replace token with the token you created in step 2
        • Replace file=@/... with a path to an existing file in your computer

          curl -F "token=ffbe3a3002f235bf9d01fd9369e10b66" -F "filearea=private" -F "file=@/Users/juanleyva/mm.mp4" http://localhost/m/stable_master/webservice/upload.php

      5. Confirm that you see JSON response including a exception (Sorry, but you do not currently have permissions to do that (Manage files on own private file areas))
      6. Replace filearea=private with filearea=draft
      7. Execute the CURL command. Check that in the database (table files) you see an entry for the new file created (the JSON response will contain the file information)
      8. As admin in Moodle, enable the moodle/user:manageownfiles capability
      9. Execute the CURL command replacing again filearea=draft with filearea=private (you should see a JSON response containing the uploaded file information)
      10. Log in as the student and check that the file was correctly uploaded to your private file area
      Show
      As admin: enable "Mobile services": Plugins ► Web Services ► Mobile Create a Token for the student user Click on Site administration ► Plugins ► Web services ► Manage tokens Edit the Authenticated User system Role, disable the moodle/user:manageownfiles capabilities Try to upload an existing file to your private file area using curl: Replace token with the token you created in step 2 Replace file=@/... with a path to an existing file in your computer curl -F "token=ffbe3a3002f235bf9d01fd9369e10b66" -F "filearea=private" -F "file=@/Users/juanleyva/mm.mp4" http://localhost/m/stable_master/webservice/upload.php Confirm that you see JSON response including a exception (Sorry, but you do not currently have permissions to do that (Manage files on own private file areas)) Replace filearea=private with filearea=draft Execute the CURL command. Check that in the database (table files) you see an entry for the new file created (the JSON response will contain the file information) As admin in Moodle, enable the moodle/user:manageownfiles capability Execute the CURL command replacing again filearea=draft with filearea=private (you should see a JSON response containing the uploaded file information) Log in as the student and check that the file was correctly uploaded to your private file area
    • Affected Branches:
      MOODLE_27_STABLE, MOODLE_28_STABLE
    • Fixed Branches:
      MOODLE_27_STABLE, MOODLE_28_STABLE, MOODLE_29_STABLE
    • Pull from Repository:
    • Pull Master Branch:
      MDL-49426-master

      Description

      According MDL-22236 for sending files via Web Services you need to upload a file via webservice/upload.php to the draft area, and then move the draft file to it's correct location using another web service.

      This is ok, but if the user has his private files disabled (manageownfiles capability disabled), he is not going to be able to upload files to the draft area because webservice/upload.php do

      require_capability('moodle/user:manageownfiles', $context);

      This is a bug, this capability should be checked only if the user is trying to upload files to his private file area.

      More info:
      https://docs.moodle.org/28/en/Capabilities/moodle/user:manageownfiles

        Attachments

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Fix Release Date:
                11/May/15