When setting a Root Folder in a file/image field, we still have access to All Files, My Files and Recent Files.

[Natetronn]

Describe the Bug

Note: I'm setting directus_files and directus_folders permissions aside for this discussion.

The Root Folder interface option limits uploads to a single folder, if set, otherwise uploads go into the upper most Root Folder of the File Library (the default). If it's the upper most File Library folder, we have access to select a file/image from all folders, plus All Files, My Files, Recent Files sidebar menu options as well.

But when setting a Root Folder to something other then the root of the library (so not the default), it limits the menu to that one folder alone, which is good, but it doesn't limit the selection of files, since we still have access to all other files available to us via the All Files, My Files and Recent files options in the sidebar.

Currently, we are in this odd place between limiting to a folder and not limiting to a folder. We can limit uploads to a folder, but when selecting files, we have access to everything else too? Not ideal (depending on one's use case.)

One suggestion to address this "no man's land" we're in now, is a checkbox that says something like, "Limit File Selection to Root Folder Only" or similar.

If that's unchecked (the default), and we do select a different Root Folder, it should act like the current default in that we should have the complete File Library menu available to us in the sidebar, including all folders and All Files, My Files and Recent files too. But since the Root Folder is set when selecting a file/image, it would drop us into the set folder and turn on the active state (css) of that menu item, so it's highlighted and also open any collapsed menu tree nodes accordingly.

I mean, if you're going to let us select any file, might as well let us select any file from any of the folders in the navigation too (permissions aside.)

Then of course, if this new checkbox is turned on (checked), it should limit uploads and selections to that one single Root Folder alone and no other options should be shown in the sidebar menu.

To Reproduce

When creating a new file or image field, we can select the Root Folder (default upload directory), as seen in the below screenshot (this is for a hero block image, for example)

But, we're still able to select file/image from other areas of the file explorer, using All Files, My Files or Recent Files, as seen here, even though the File Library sidebar menu is limited to the Root Folder (hero folder in this example):

Directus Version

v10.8.2

Hosting Strategy

Self-Hosted (Docker Image)

[Natetronn]

A quick example where the "checkbox" is checked, as to limit file uploads AND selections to the Root Folder only. Of course, verbiage should be adjusted, a note added and such a option should probably be in the second position, after Root Folder option, but you get the idea, I'm sure:

Then when selecting a file/image you have this:

If it's not set to be limited, but a Root Folder is still selected (or if it's the Root of the File Library; the default), you'd have something like this (using our hero folder as an example of a Root Folder selection):

[Natetronn]

P.S. This seemed part UI bug (depending on who you ask) and part Feature Request, but I wasn't sure where it fit best.

[seanmangar]

Having the same issue here - can be a potential security issue as the user is also able to see other users' files in a multitenant scenario. Of course they would see it publicly on a website, but seeing it here in this interface can cause all sorts of issues.

[br41nslug]

can be a potential security issue as the user is also able to see other users' files in a multitenant scenario.

In such a scenario you'll want to make sure to use actual validation rules on the API and not rely on frontend interface settings, those only apply in the browser not on the API and thus can not be used as security mechanism

[seanmangar]

Sure @br41nslug, agree on not relying on those settings for security, but it can look like a security issue for users.

Just to explain the bigger picture of how the lack of this specific bug/feature can cascade further:

• Users upload their own profile picture
• Users should be "sandboxed" in Directus to only see files uploaded by themselves, so I apply permissions that they can only see files they upload themselves into a specific directory containing profile pictures
• However, profile pictures are also assets used for public profiles, and should load for the user when he navigates to the website.
• So therefore, I actually need to grant access to see all files in the directory containing profile pictures
• Granting the access above then shows everyone's profile pictures in "All files" as explained in the original post

While the files are only read-access, it is really awkward if users accidentally navigate to all files and see every other user's profile pictures in one place. Having this feature would be super helpful to improve the user experience.