File downloadable, regardless of FE Group

[cyrotek]

It seems I found a bug, whatever usergroup I have, i can download a file when it's linked somewhere. The folder it contains does have a specific group restriction that does not match my own group. I also tried to create a new Folder and add a random file, give the folder a random group (which my test user doesn't have) and try to download it. Successful...

I'm running Typo3 11.5.31 with the Extension in 5.05.

[TimWilms]

Hi @cyrotek ,

Wij have looked into your issue, but we can't seem to reproduce the problem that you are experiencing. Did you create a separate local file storage that has "Is publicly available" turned off? Please make sure you do so. This will not work on the default content local storage.

[kanow]

I can confirm that issue in TYPO3 12.4.14. I have a protected folder outside of the web root in my local docker environment.
The storage has the "Is publicly available" setting turned off. I set acces for the storage to "show if user is logged in". So I assume that only logged in users can see/download files in it. But if I log in with a fe user and copy the generated link to that protected file, then I can paste it in another browser window and see/download the file without login to page.

I'm using version 5.0.7 of fal_securedownload.

[FamousWolf]

After some tests I've been able to reproduce this problem. It happens when there are no restrictions set to the file or folders the file is in. The problem is in BeechIt\FalSecuredownload\Security\CheckPermissions::checkFileAccess. If the storage is not public and there's no backend session (or the backend user does not have access to the storage), the access for the folders and file are checked. If no access restrictions are set to the folders and files it returns true, but it should return false.

I'll have to test if removing the return true here doesn't cause other problems.

[FamousWolf]

Removing the return true if there is no access restriction to the folders and file will mean the file is never accessible. The problem is that you can create a tx_falsecuredownload_folder record on the storage root, but it's not checked. We'll have to add a check for that.

[FamousWolf]

My solution wasn't a solution. The functionality is correct.

@cyrotek @kanow It could be that you're logged in to the backend. If so, any browser window/tab with the same session will have access to all files your backend user has access to regardless of any frontend login.