Added an option to show file actions in media modals

[p-decoraid]

No description provided.

[owen2345]

What about to use this in permissions? (roles)

[p-decoraid]

What do you mean?

[owen2345]

Like this:

By this way only users with that permission can show the actions.
what do you think?

[p-decoraid]

I would agree if we were talking about a user's ability to create folders, but the change here is purely visual. If anything the permission should be on the action, and then the link would only be rendered if the user has the permission to do the action.

Alternatively, perhaps always showing the create folder link is a better way forward. What was the reasoning for not showing this link in the partial?

[owen2345]

currently media actions is available in media section because that section is accessible only if you have permission to access, instead the modal media can be opened in any place with/without media permission and there is a security problem because anyone can delete files from other users.

[p-decoraid]

Does the controller that permit media deletion check permissions?

[owen2345]

not yet, for now it is managed only by

@show_file_actions = true

[p-decoraid]

Then perhaps the modal should be rendered if and only if the user has permissions to delete files?

[owen2345]

No, the modal is ok.
The file actions in the modal, like delete folder/file should be visible only if you have permission like this:

What do you think?

[p-decoraid]

To be honest I am not sure, in the old camaleon version we had an "add folder" button (even though it was never used) and in the new version we don't. I need to understand file uploads and permissions better to have an informed opinion.