Issue with images in custom pages since enh/308-file-access

[andreasmuellergin]

Dear devs,
First of all, thank you!!!

i updated to the most recent CustomPages module version today and noticed, that after clearing my browser-cache i am now not able to see any images in my custom pages anymore.

The developer console points me to (Error:401) failing requests to {humhub}/file/file/download?guid={fileGuid}&hash_sha1={hash}.
Those links are embedded in the Richtext pages we have and all of them now lead to this behaviour.
Looking into the database i observed that those files added through the Richtext-Editor don't have a content_id set, i wonder if thats the reason for them to deliver 401s after your latest changes.

In order to bring my images back to be displayed temporarily again, i replaced your recently changed "TemplateContentActiveRecord" and "TemplateInstance" classes back to the state tagged as v1.10.7 on my server - that's working.

Please tell me if i am doing something wrong in my custom pages, i am also happy to share more details if needed.

Best regards, Andreas

[yurabakhtin]

@luke- Yes, I can reproduce the bug when file is linked to humhub\modules\custom_pages\modules\template\models\RichtextContent, we need to find humhub\modules\custom_pages\modules\template\models\TemplateInstance of the record in order to get object(Custom Page) to check CustomPage->content->canView(). Now I don't see a direct linking between these recrods.

It was done here #311.

[yurabakhtin]

@luke- Fixed in the PR #350.

I have tested with:

• 3 users: Admin, Normal user, Guest
• Template page and simple Custom page
• 3 Visibility states: Admin only, Member only, Member & Guest.

The PR #350 fixes all cases except of one:

• Normal user + simple Custom page + Admin only

The normal user sees an image of the custom page but it should not be visible because the custom page is hidden for the user.
To fix this case I have created the core PR humhub/humhub#7241, I think we should firsty check the ViewableInterface->canView() and only then record->content->canView() because Custom Page has a specific checking for the option "Admin only" here:

if ($this->admin_only && !static::canSeeAdminOnlyContent($this->content->container)) {
    return false;
}

but the core method record->content->canView() has no it and the method allows any even private Global content for all logged in users:

// Check global content visibility, private global content is visible for all users
if (empty($this->contentcontainer_id) && !Yii::$app->user->isGuest) {
    return true;
}

So the core PR solves the issue.

[Gilbertdelyon]

@yurabakhtin
Same issue on 2 of our sites. Images are not displayed in custom pages
Please, will you release an update soon?

[luke-]

Will be fixed with Custompages 1.10.9 & HumHub 1.16.3+