Is "Replace file" a potential security hole?

Question

I am new to Craft, but have a lot of experience with other CMS systems.

I have a very specific question about Assets. I have an intern who has been given access to a Craft site; for a particular Asset Source, the intern has "View source" and "Upload files" privileges, but he does not have "Create subfolders" and "Remove files" privileges. But even though the intern cannot remove a file when logged in, he can still replace it with another. This seems to be a huge security issue.

I have tried everything to get around this issue, including configuring the image field to "Restrict uploads to a single folder." The problem here again is that I cannot restrict the intern to his folders only; he can see all the Asset folders and can replace any file -- either through malice or incompetence.

Denying the right to upload files for the intern is not going to work either because I do need him to be uploading files for the entries he is creating.

Any help would be appreciated here as this is a real show-stopper.

Cheers!

Answer 1

The problem here again is that I cannot restrict the intern to his folders only; he can see all the Asset folders and can replace any file -- either through malice or incompetence.

Unless I'm missing something you want to be able to jail a user to only his folders?

I just tried this. While jailing a user to his own folder site wide isn't (currently) possible, what you're doing should be working; you have to do that on a field-by-field basis. Make sure you're jailing the the right field?

When your intern goes to edit an entry, he shouldn't be able to replace an asset file in another folder if he doesn't have upload permission in the asset's source folder.

Make sure only his asset source is checked. For example: I created 2 asset sources: Intern Images and Images. As you mentioned, the only folders the intern can view and upload is Intern Images; everything else is unchecked.

To test, I made a sample entry with my admin user and selected a PDF in a source that the intern user doesn't have access to. When I go to edit that entry as my Intern user, I can see the other assets in that folder—unless I've jailed it to a single folder—but I can't replace the actual asset because I don't have upload permission on that asset source. I can of course swap the asset for something else but the original asset FILE (the PDF's content) is left untouched.

If you're asking about replacing files that the Intern has access to as well, that's a whole other bag of worms and IMO trust issues. Security is a 2-way street.

However, I wonder if you could write a plugin to intercept the upload request and rename it before Craft has a chance to fire the "would you like to replace the file" so you always have a unique file name? IMO that gets touchy because you start to have 2 or 3 different versions floating around and that ends up causing even more stress.

Practically speaking, WordPress actually does this by default (appending -1, -2 to a file) and in my experience, it can drive users crazy. If you upload a file and you realize you have a typo or some part of your image still needs work after approval—and that file path is already linked from a couple spots on the server—you end up deleting the file and then reuploading again. Craft's method of asset management is so much better in this respect. But with great power comes great responsibility, as they say.

Answer 2

I'd classify this as a feature request for a "Replace Asset" user permission.

I think it'd be a security related "privilege escalation" bug if we supported it and you found a way to get around it or it just wasn't working.

For the record, we do check existing permissions on file upload and we also verify that the file you want to replace with is allowed within the allowedFileExtensions and extraAllowedFileExtensions config settings.