Protected assets are viewable if embedded outside a WYSIWYG

[brynwhyman]

Overview

It appears that protected assets are still able to be accessed by anonymous users if these protected assets are embedded in a page outside of a WYSIWYG field, for example in the default 'file block' created to embed files on a page.

Whereas, if you add a protected file to a page via a WYSIWYG field, when a user who does not have permissions to accesses that file attempts to view it, they will correctly see a broken image link.

It could be expected that this exposes the following scenario:

• A site has a large number of CMS content editors (who can view draft pages)
• A special page has been drafted to publicise a still-to-be-released sensitive report. The report has strict view permissions so only a small group of users can view it. It has been added to the draft page for download via a 'file block'
• While the intention is for this report to be inaccessible by the majority until it is made public, it will actually be accessible by everyone who has access to the draft page, outside of the group with permission to view it.

Steps to recreate

1. Add a file to the Files area, set 'Who can view this file' to "Only logged-in users"
2. Create a blocks page, add a File Block, add the new file to the block, save and publish the page.
3. In an incognito browser, view the publish page.
4. Expected result: The file should not be visible as you are not logged-in
5. Actual result: The file can be viewed by people outside of the view group, in this case, 'anonymous users'.

Related issues

• I've raised this as a public issue as issues of a similar nature have been dealt with in the open previously, see:
  • File::canView() not checked when a File is linked from a Page #220
  • Fix image grant policy #402

[michalkleiner]

Is it possible that the File block owns the file and therefore publishes it? Is the file itself published with limited permissions or kept only in draft? What is the state of the file after publishing the page?

[brynwhyman]

Hey @michalkleiner, the publish will cascade to the file but even so the file has access permissions on it that should restrict who can view the file.

In contrast, using a WYSIWYG field, the following works as expected:

1. Add a file to the Files area, set 'Who can view this file' to "Only logged-in users"
2. Create a blocks page, add a Content Block, via the WYSIWYG using the 'Insert from Files' option to add the new file, save and publish the page.
3. In an incognito browser, view the published page.
4. The file should not be visible as you are not logged-in (as expected)