<blockquote>
  <p>The problem here again is that I <strong>cannot restrict the intern to his folders only;</strong> he can see all the Asset folders and can <strong>replace any file</strong> -- either through malice or incompetence.</p>
</blockquote>

<p>Unless I'm missing something you want to be able to jail a user to <strong>only his folders?</strong></p>

<p>I just tried this. While jailing a user to his own folder <strong>site wide</strong> isn't (currently) possible, what you're doing should be working;  you have to do that on a field-by-field basis. Make sure you're jailing the the right field?</p>

<p>When your intern goes to edit an entry, he shouldn't be able to <strong>replace</strong> an asset file in another folder if he doesn't have upload permission in the asset's source folder.</p>

<p>Make sure only his asset source is checked.  For example: I created 2 asset sources: <code>Intern Images</code> and <code>Images</code>.  As you mentioned, the only folders the intern can view and upload is  <code>Intern Images</code>; everything else is unchecked.</p>

<p><img src="https://i.sstatic.net/m8HFK.png" alt="enter image description here"></p>

<p>To test, I made a sample entry with my admin user and selected a PDF in a source that the intern user doesn't have access to. When I go to edit that entry as my Intern user, I can see the other assets in that folder—unless I've jailed it to a single folder—but I can't replace the actual asset because I don't have upload permission on that asset source. I can of course swap the asset for something else but the original asset FILE (the PDF's content) is left untouched.</p>

<p><img src="https://i.sstatic.net/36Lfg.png" alt="enter image description here"></p>

<p>If you're asking about replacing files that the Intern has access to as well, that's a whole other bag of worms and IMO trust issues. Security is a 2-way street. </p>

<p>However, I wonder if you could write a plugin to intercept the upload request and rename it before Craft has a chance to fire the "would you like to replace the file" so you always have a unique file name? IMO that gets touchy because you start to have 2 or 3 different versions floating around and that ends up causing even more stress.</p>

<p>Practically speaking, WordPress actually does this by default (appending -1, -2 to a file) and in my experience, it can drive users crazy. If you upload a file and you realize you have a typo or some part of your image still needs work after approval—and that file path is already linked from a couple spots on the server—you end up deleting the file and then reuploading again. Craft's method of asset management is so much better in this respect. But with great power comes great responsibility, as they say.</p>

CC BY-SA 3.0
2015-03-16T23:39:23.427Z
RitterKnight: Your solutions would work if I have one intern.  If I have 10 interns, I will have to create 10 new fields, each of mapped to a jailed folder.  The Entry creation form will be a jumbled mess -- and I can't imagine how messy the twig markup will have to be to output that data.

I am not exactly sure how the solution needs to be implemented, but when am using ExpressionEngine I have a plug-in that restricts the uploads to a single folder based on entry slug.
Jim Newton
CC BY-SA 3.0
2015-03-16T23:41:03.810Z
One quick solution would be to figure out how to use environmental variables when defining the Asset itself.  The included sample about environmental variables already talks about using different folders for "prod" and "dev" environments; I could create an array for different users instead such as "billgates" and "larryellison" etc. (For security reasons, I might have to define a new field for each user called "nickname" which can be used when creating a folder.)  The trust issue is very difficult for me to address.  As a technical guy, I wouldn't want to leave anything to user discretion.
Jim Newton
CC BY-SA 3.0
2015-03-16T16:46:18.257Z
2015-03-16T16:46:18.257Z
RitterKnight
<p>I'd classify this as a feature request for a "Replace Asset" user permission.</p>

<p>I think it'd be a security related "privilege escalation" bug if we supported it and you found a way to get around it or it just wasn't working.</p>

<p>For the record, we do check existing permissions on file upload and we also verify that the file you want to replace with is allowed within the <a href="http://buildwithcraft.com/docs/config-settings#allowedFileExtensions" rel="nofollow">allowedFileExtensions</a> and <a href="http://buildwithcraft.com/docs/config-settings#extraAllowedFileExtensions" rel="nofollow">extraAllowedFileExtensions</a> config settings.</p>

CC BY-SA 3.0
2015-03-16T16:36:21.803Z
Just want to clarify the situation that I am facing.  The issue is not with the type of file extension; it's related to the fact that an intern (who doesn't have the rights to edit somebody else's entry) can easily mess up their entry by simply replacing an image.
Jim Newton
CC BY-SA 3.0
2015-03-16T16:42:21.103Z
I just want to make sure that I am not missing something obvious.  Has nobody else who is using Craft come across this issue wherein one of the users who has access to the Control Panel has "accidentally" replaced an image that is currently used by somebody else's entry?

How do you prevent one user (who has upload rights) to replace somebody else's image file?  If I have a disgruntled employee or an intern, this could be a real issue.  How would I explain myself to the management when they ask why wrong images are appearing on different pages?
Jim Newton
CC BY-SA 3.0
2015-03-16T16:55:59.620Z
Since Brad's calling this a feature request, I'd recommend creating a new thread over at [feedback.buildwithcraft.com](http://feedback.buildwithcraft.com/forums/285221-feature-requests)... I don't want to speak for them, but they generally take security related issues very seriously.
Lindsey D
CC BY-SA 3.0
2015-03-18T16:18:01.687Z
I can't reproduce replacing a file with another one if the user doesn't have permission to upload it to that source but being able to view another source's assets when you are choosing an asset on a entry field—one that you shouldn't be able to view—seems like a bug to me.
RitterKnight
CC BY-SA 3.0
2015-03-16T03:34:33.487Z
2015-03-16T03:52:52.097Z
2015-03-16T03:52:52.097Z
Brad Bell
<p>I am new to Craft, but have a lot of experience with other CMS systems.</p>

<p>I have a very specific question about Assets.  I have an intern who has been given access to a Craft site; for a particular Asset Source, the intern has "View source" and "Upload files" privileges, but he does not have "Create subfolders" and "Remove files" privileges.  But even though the intern cannot remove a file when logged in, he can still replace it with another.  This seems to be a huge security issue.</p>

<p>I have tried everything to get around this issue, including configuring the image field to "Restrict uploads to a single folder."  The problem here again is that I cannot restrict the intern to his folders only; he can see all the Asset folders and can replace any file -- either through malice or incompetence.</p>

<p>Denying the right to upload files for the intern is not going to work either because I do need him to be uploading files for the entries he is creating.</p>

<p>Any help would be appreciated here as this is a real show-stopper.</p>

<p>Cheers!</p>

CC BY-SA 3.0
2015-03-15T06:46:43.103Z
This seems like an issue that walks the fine line between "bug" and "feature request". Either way, I'd recommend contacting support@buildwithcraft.com directly to get their thoughts.
Lindsey D
<assets><security>
Is "Replace file" a potential security hole?
# Is "Replace file" a potential security hole?

(Asked by: username_0 on 2015-03-14)

I am new to Craft, but have a lot of experience with other CMS systems.

I have a very specific question about Assets. I have an intern who has been given access to a Craft site; for a particular Asset Source, the intern has "View source" and "Upload files" privileges, but he does not have "Create subfolders" and "Remove files" privileges. But even though the intern cannot remove a file when logged in, he can still replace it with another. This seems to be a huge security issue.

I have tried everything to get around this issue, including configuring the image field to "Restrict uploads to a single folder." The problem here again is that I cannot restrict the intern to his folders only; he can see all the Asset folders and can replace any file -- either through malice or incompetence.

Denying the right to upload files for the intern is not going to work either because I do need him to be uploading files for the entries he is creating.

Any help would be appreciated here as this is a real show-stopper.

Cheers!

**Tags:** assets, security
> **Comments:**
> **username_1**: This seems like an issue that walks the fine line between "bug" and "feature request". Either way, I'd recommend contacting support@buildwithcraft.com directly to get their thoughts.  

---

## 2 answers

### Answer by username_2 on 2015-03-16. Score: 2

> The problem here again is that I **cannot restrict the intern to his folders only;** he can see all the Asset folders and can **replace any file** -- either through malice or incompetence.

Unless I'm missing something you want to be able to jail a user to **only his folders?**

I just tried this. While jailing a user to his own folder **site wide** isn't (currently) possible, what you're doing should be working; you have to do that on a field-by-field basis. Make sure you're jailing the the right field?

When your intern goes to edit an entry, he shouldn't be able to **replace** an asset file in another folder if he doesn't have upload permission in the asset's source folder.

Make sure only his asset source is checked. For example: I created 2 asset sources: `Intern Images` and `Images`. As you mentioned, the only folders the intern can view and upload is `Intern Images`; everything else is unchecked.

![enter image description here](https://i.sstatic.net/m8HFK.png)

To test, I made a sample entry with my admin user and selected a PDF in a source that the intern user doesn't have access to. When I go to edit that entry as my Intern user, I can see the other assets in that folder—unless I've jailed it to a single folder—but I can't replace the actual asset because I don't have upload permission on that asset source. I can of course swap the asset for something else but the original asset FILE (the PDF's content) is left untouched.

![enter image description here](https://i.sstatic.net/36Lfg.png)

If you're asking about replacing files that the Intern has access to as well, that's a whole other bag of worms and IMO trust issues. Security is a 2-way street.

However, I wonder if you could write a plugin to intercept the upload request and rename it before Craft has a chance to fire the "would you like to replace the file" so you always have a unique file name? IMO that gets touchy because you start to have 2 or 3 different versions floating around and that ends up causing even more stress.

Practically speaking, WordPress actually does this by default (appending -1, -2 to a file) and in my experience, it can drive users crazy. If you upload a file and you realize you have a typo or some part of your image still needs work after approval—and that file path is already linked from a couple spots on the server—you end up deleting the file and then reuploading again. Craft's method of asset management is so much better in this respect. But with great power comes great responsibility, as they say.

> **Comments:**
> **username_0**: RitterKnight: Your solutions would work if I have one intern.  If I have 10 interns, I will have to create 10 new fields, each of mapped to a jailed folder.  The Entry creation form will be a jumbled mess -- and I can't imagine how messy the twig markup will have to be to output that data.  I am not exactly sure how the solution needs to be implemented, but when am using ExpressionEngine I have a plug-in that restricts the uploads to a single folder based on entry slug.  
> **username_0**: One quick solution would be to figure out how to use environmental variables when defining the Asset itself.  The included sample about environmental variables already talks about using different folders for "prod" and "dev" environments; I could create an array for different users instead such as "billgates" and "larryellison" etc. (For security reasons, I might have to define a new field for each user called "nickname" which can be used when creating a folder.)  The trust issue is very difficult for me to address.  As a technical guy, I wouldn't want to leave anything to user discretion.  

---

### Answer by username_3 on 2015-03-16. Score: 1

I'd classify this as a feature request for a "Replace Asset" user permission.

I think it'd be a security related "privilege escalation" bug if we supported it and you found a way to get around it or it just wasn't working.

For the record, we do check existing permissions on file upload and we also verify that the file you want to replace with is allowed within the [allowedFileExtensions](http://buildwithcraft.com/docs/config-settings#allowedFileExtensions) and [extraAllowedFileExtensions](http://buildwithcraft.com/docs/config-settings#extraAllowedFileExtensions) config settings.

> **Comments:**
> **username_0**: Just want to clarify the situation that I am facing.  The issue is not with the type of file extension; it's related to the fact that an intern (who doesn't have the rights to edit somebody else's entry) can easily mess up their entry by simply replacing an image.  
> **username_0**: I just want to make sure that I am not missing something obvious.  Has nobody else who is using Craft come across this issue wherein one of the users who has access to the Control Panel has "accidentally" replaced an image that is currently used by somebody else's entry?  How do you prevent one user (who has upload rights) to replace somebody else's image file?  If I have a disgruntled employee or an intern, this could be a real issue.  How would I explain myself to the management when they ask why wrong images are appearing on different pages?  
> **username_1**: Since Brad's calling this a feature request, I'd recommend creating a new thread over at [feedback.buildwithcraft.com](http://feedback.buildwithcraft.com/forums/285221-feature-requests)... I don't want to speak for them, but they generally take security related issues very seriously.  
> **username_2**: I can't reproduce replacing a file with another one if the user doesn't have permission to upload it to that source but being able to view another source's assets when you are choosing an asset on a entry field—one that you shouldn't be able to view—seems like a bug to me.  

---

