I've created an asset source: 'restricted uploads' and a user: 'Jim', who is a member of the 'staff' User Group.

Neither 'Jim' or the 'staff' group have any privileges for the 'restricted uploads' source.

If Jim logs into the admin panel and goes to 'Assets' in the sidebar, he can't see the "restricted uploads" source (as expected).

However, if Jim opens a file selection modal which includes access to the "restricted upload" source he can see "restricted uploads" listed in the modal source sidebar, and can select files from that folder.

Shouldn't Jim's missing asset "View source" privilege prevent him from being able to see the files in the "restricted upload" folder?

1 Answer 1


There is an issue filed for this here https://github.com/craftcms/cms/issues/887 that you might want to consider thumbs-upping or commenting on.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.