Standard File/Folders security and permissions

Description of bug

Users are able to access assets files in a Standard folder without View and Read privileges.

Steps to reproduce

1. Go to Site Assets and create Standard type folder
2. Add any asset to folder (i.e. any txt file)
3. Go to folder Properties -> Permissions
4. Disallow view and read permission
5. Get the URL of a file from the Standard folder
6. Log out from DNN
7. Navigate to the file URL

Current result

The file opens without having the permission to view it.

Expected result

Expected that file should be secured by the permissions and users cannot view or read it without having the permission to do so.

Screenshots

Affected version

• 10.0.0 nightly build
• 9.4.1 nightly build
• 9.4.0 release candidate
• 9.3.2 latest supported release

[mitchelsellers]

At this point in time, the standard folder provider has never been suggested as the pathway to share secure file assets. The permissions as applied to “Standard” folders are simply permissions set to control who can view through the DNN Interfaces those folders etc.

Changing this direct linking behavior would have a catastrophic impact on site performance as remember this would impact every image or other asset managed through the HTML Editors. Therefore I agree that @bdukes is correct in that if security is desired, you need to use the “Secure” folder type.

Lastly: PLEASE remember any security concerns should be directed to [e-mail] and not directly here. I’m leaving this here as this is a documented feature, but for future reference, we need to be sure to adhere to the policies to not draw undue attention.

[bdukes]

Option three has been the position of the team, historically. If you need security for files, you must use a different folder provider.