Restricted access to assets in Redactor

Question

I have created several asset sources in craft and now i created user groups, with different view rights to this sources. When a user with restricted rights goes to the "assets" tab in craft, the rights management works as excepted: the user only see assets sources, where he has access to. But in redactor wysiwyg editor, using the insert image button or link to a asset function, it shows always all asset sources, even if the user has no view access to. Is there a way to restrict this list, based on users "view" permissions? Maybe i missed it and there is something like a global config option (for example: restrictAssetsInRedactor = true)?

When i look in firebug, i see, that the modal window is called without any sources. Is there a way to modify/overwrite this call with a custom plugin?

Answer 1

There is no native way to limit which sources appear in the asset window. I imagine it can be accomplished with a custom field type. This would be a great feature for future releases; I recommend adding it to the Feature Requests forum.

Answer 2

I found a solution to change the allowed asset sources in redactor.

If you like to change the allowed asset sources global without making any difference between users/groups, than you can use the following steps:

1. Open the javascript file "/craft/app/resources/js/RichTextInput.js"
2. Add the following code on line 100: "sources: ['folder:1', 'folder:2']," (the id's represents your asset source ids)
3. Replace the file "/craft/app/resources/js/compress/RichTextInput.js" with your file (optional: for better performance compress the javscript file after replacing)
4. Refresh your craft dashboard in the browser

The second option would be to include a second, modified RichTextInput.js File in Craft backend. So it would be possible to write a plugin checking the "View" rights of the user and set the asset sources in the javascript dynamically.

Notice: I have tested to include the same, modified file a second time and was able to overwrite the assets sources in this way, but i did not wrote any plugin yet.

Please note:

• A craft update could update also update the RichTextInput.js file - so you should test the functionality after each update.
• It's not a real "permission" check, it only hide/show asset sources
• The solution is only testet with local asset sources (but should work with other as well)

And finally: I know, the solution is really quick and dirty, but better than nothing... I hope a Craft update coming soon and brings a real solution for this issue.