topic Re: Seperate view and download permissions for custom types in Alfresco Archive

Seperate view and download permissions for custom types

aniruddh — Mon, 06 Aug 2012 13:22:37 GMT

Hi, I have a custom content model which has a base type from which other content types inherit. I have the following two requirements and I would ideally like to use custom permissions.1. Seperate permissions for accessing node content (view) and downloading the node content2. For the content type

Re: Seperate view and download permissions for custom types

afaust — Mon, 06 Aug 2012 22:23:38 GMT

Hello,

#1 is quite tricky, since you need the same permission for view as for download. The simplest option I see here is in specifying a custom permission set for your type, with a custom permission for download and only use this permission for Share DocLib UI action evaluation. I see no way to effectively guard against download via direct URI (if known or reconstructed by user), unless you are willing to replace the standard download services with custom implementations that check the permission on the repo layer.

#2 can be achieved without custom permissions. Simply define a rule or policy that transfers ownership to the OwnableService.NO_OWNER value when the node is created. This is the best opion since fiddling with the ownership permission on a definition level will likely produce some unwanted side effects due to its global usage.

Regards
Axel

Re: Seperate view and download permissions for custom types

aniruddh — Tue, 07 Aug 2012 06:41:56 GMT

Thanks Axel for your reply. I had a similar thoughts regarding #1 and was thinking of implementing the permission checks in a filter on the download servlet. The filter can check for the custom permission and send a response accordingly. Do you think this is a good idea?

Re: Seperate view and download permissions for custom types

aniruddh — Wed, 08 Aug 2012 09:28:55 GMT

I have tried creating a rule on a space to add the ownable aspect. But it does not work. I have a space named "Test Space" inside the users Home Space and added a rule to the space to add ownable aspect to any content. However, the delete button is still visible and the content can be deleted by the user. I have also tried creating a node policy OnCreateNodePolicy for my custom type and add the ownable aspect but with the same results. Please help.

Re: Seperate view and download permissions for custom types

afaust — Fri, 10 Aug 2012 20:11:43 GMT

Hello,

inside the users home space, it does not matter if the user is the owner of the content or not - the user the space belongs to always has administrator (i.e. coordinator) privileges on it and every content contained therein. So this is not a proper test of your rule - you should try it in a different location. The only way to achieve this is the users home space is by setting the inheritsParentPermissions flag to false in addition to revoking the ownership on the content - keep in mind though, for the user to have any access afterwards, you need to grant him explicit permissions on that node.

Regards
Axel