Protecting Media files e.g. PDF Documents, Images and other files behind user authentication

[PanickingLynx]

Hello Sulu Community!
I am currently trying to protect some documents that I've uploaded via the Sulu Admin Interface by only allowing certain users to download them, meaning users in my Website security system which I've set up with Sulu Community Bundle. Everything has worked great up until now, where I can't seem to find the option to lock certain files / folders behind user authentication.
Am I missing something?

I've tried:

• Giving the root folder of the files permissions for the website systems in which I revoked the "View" permission for everyone except the specific user
• Giving every user in the website security system it's own group to use as a permission holder

Any ideas to what I might be doing wrong?

Best regards
Panic

[alexander-schranz]

You need atleast a security system on one of your webspaces if I remember correctly. Then security on website site is activated and the following lines will validate if you are allowed to access the media or not inside the new security system.

sulu/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php

Lines 145 to 155 in c4867cb

	if ($this->securityChecker) {
	$this->securityChecker->checkPermission(
	new SecurityCondition(
	MediaAdmin::SECURITY_CONTEXT,
	null,
	Collection::class,
	$fileVersion->getFile()->getMedia()->getCollection()->getId()
	),
	PermissionTypes::VIEW
	);
	}

[PanickingLynx]

Hello alexander,
where would I apply the permissions to the specific file I want to protect? I have a security system in place and I have revoked the view permission for all unwanted groups, yet the file is still downloadable even for unauthenticated users. Is it because my Security system doesn't start at ^/ ?

Best regards
Panic

[alexander-schranz]

Permissions are always on collection base there is currently no possibility to set it on file base. If you want to have it on file base you would need to extend it in your project and create a security listener via a request listener.

Sulu supports permissions via its security checker on collection level when the webspace has a security system enabled. Not sure yet if check-permission need to be true for this case. But a security system would be required to have alteast the anonymous role which you can give permissions or not.

https://docs.sulu.io/en/2.5/cookbook/user-context-caching.html

Still another example is that specific medias inside specific collection should never be available from the website. Then you can go the way like the SuluFormBundle does via a request listener like above: https://github.com/sulu/SuluFormBundle/blob/2.5/Event/ProtectedMediaSubscriber.php

[PanickingLynx]

Sorry maybe I haven't made clear enough what I want to build. I am still quite new to sulu and Symfony.

I'll take you to through the steps I would like my application to accomplish, the collection system would make sense for it.

1. The user logs into the protected area: /area
2. The user can now advance to a document library with documents that have been uploaded to sulu specifically for them: /area/documents
3. The user will only see a list of links for the documents that are meant for them, nothing else.

Maybe I am asking a bit much of the sulu permission system but I thought i could do it with the inbuilt permission system on the collections.

Sorry for the inconvinience, best regards.
Panic

[NeuralClone]

Sorry maybe I haven't made clear enough what I want to build. I am still quite new to sulu and Symfony.

I'll take you to through the steps I would like my application to accomplish, the collection system would make sense for it.

1. The user logs into the protected area: /area
2. The user can now advance to a document library with documents that have been uploaded to sulu specifically for them: /area/documents
3. The user will only see a list of links for the documents that are meant for them, nothing else.

Maybe I am asking a bit much of the sulu permission system but I thought i could do it with the inbuilt permission system on the collections.

Sorry for the inconvinience, best regards. Panic

I ran into a similar problem a while back.

One possible workaround involves adding the ^/media path to the access_control section of your config/packages/security.yaml file. For example:

  access_control:
    # ...
    - { path: ^/admin, roles: ROLE_USER }

    - { path: ^/media, roles: ROLE_USER }
    - { path: ^/.*, roles: PUBLIC_ACCESS }

The downside to this approach is it breaks downloads for media files that are publicly accessible, and it isn't what I ended up doing.

[PanickingLynx]

Hello @NeuralClone ,
thank you for the comprehensive reply. I solved the issue by moving my protection zone from ^/ to ^/area.
I forgot to close this, sorry!

Best regards
Panic

[PanickingLynx]

I solved the problem by letting the protection zone start behind a different path than ^/ for example ^/area . so that /media doesn't get affected by the recursion of the protection zone.

[NeuralClone]

You're looking to protect specific media collections outside of the Sulu admin panel, correct? If not, then perhaps I've misunderstood the original question. If that's the case, then my apologies and I'll create a new issue to continue discussing things there since I don't want to hijack your discussion.

[PanickingLynx]

No worries :)
I am still very new to Symfony so I probably expressed myself badly :)