Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit 54e7570

Browse filesBrowse files
1 parent 29b1fa0 commit 54e7570
Copy full SHA for 54e7570

File tree

3 files changed

+55
-12
lines changed
Filter options

3 files changed

+55
-12
lines changed

‎wire/modules/Inputfield/InputfieldFile/InputfieldFile.module

Copy file name to clipboardExpand all lines: wire/modules/Inputfield/InputfieldFile/InputfieldFile.module
+5-1Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -673,7 +673,11 @@ class InputfieldFile extends Inputfield implements InputfieldItemList, Inputfiel
673673
$fieldName = (string) $this->hasField;
674674
}
675675

676-
$postUrl = $page ? $page->editUrl() : '';
676+
if($page instanceof User && wireInstanceOf($this->wire->process, 'ProcessProfile')) {
677+
$postUrl = './';
678+
} else {
679+
$postUrl = $page ? $page->editUrl() : '';
680+
}
677681

678682
if($nameAttr != $fieldName && $fieldName && $postUrl) {
679683
// file context for output after upload in case upload starts from a

‎wire/modules/PagePermissions.module

Copy file name to clipboardExpand all lines: wire/modules/PagePermissions.module
+39-7Lines changed: 39 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
* if(!$page->viewable()) { echo "sorry you can't view this"; }
1010
* ...and so on...
1111
*
12-
* ProcessWire 3.x, Copyright 2023 by Ryan Cramer
12+
* ProcessWire 3.x, Copyright 2025 by Ryan Cramer
1313
* https://processwire.com
1414
*
1515
* Optional special permissions that are optional (by default, not installed):
@@ -221,7 +221,18 @@ class PagePermissions extends WireData implements Module {
221221
if($this->hasPagePublish === null) {
222222
$this->hasPagePublish = $this->wire()->permissions->get('page-publish')->id > 0;
223223
}
224-
224+
225+
/*
226+
* Potential addition (cc:@adrianbj)
227+
* cancel editable if page in trash, not restorable, and trash page not listable?
228+
if($page->isTrash() && !$page->restorable()) {
229+
$trashId = $this->wire()->config->trashPageID;
230+
if($page->id == $trashId) return false;
231+
$trashPage = $this->wire()->pages->get($trashId);
232+
if(!$trashPage->listable()) return false;
233+
}
234+
*/
235+
225236
if($this->hasPagePublish) {
226237

227238
// if user has the page-publish permission here, then we're good
@@ -243,6 +254,7 @@ class PagePermissions extends WireData implements Module {
243254
* @param Page $page
244255
* @param array $options
245256
* - `viewable` (bool): Specify true if only a viewable check is needed (default=false)
257+
* - `processName` (string): Name of Process module to consider for context. 3.0.244+ (default='')
246258
* @return bool
247259
*
248260
*/
@@ -252,16 +264,17 @@ class PagePermissions extends WireData implements Module {
252264

253265
$user = $this->wire()->user;
254266
$process = $this->wire()->process;
255-
$processName = (string) $process;
256267
$config = $this->wire()->config;
257268
$guestRoleID = (int) $config->guestUserRolePageID;
258269
$permissions = $this->wire()->permissions;
259270

260271
$defaults = array(
261272
'viewable' => false, // specify true if method is being used to determine viewable state
273+
'processName' => '',
262274
);
263275

264276
$options = count($options) ? array_merge($defaults, $options) : $defaults;
277+
$processName = $options['processName'] ? $options['processName'] : (string) $process;
265278

266279
if(!$page->id) return false;
267280

@@ -380,7 +393,8 @@ class PagePermissions extends WireData implements Module {
380393
* Returns whether the given page ($page) is viewable by the current user
381394
*
382395
* @param Page $page
383-
* @param array $options
396+
* @param array $options
397+
* - `processName` (string): Name of Process module to consider for context. 3.0.244+ (default='')
384398
* @return bool
385399
* @throws WireException
386400
*
@@ -565,13 +579,23 @@ class PagePermissions extends WireData implements Module {
565579
*
566580
*/
567581
protected function fileViewable(Page $page, $pagefile) {
568-
if($this->wire()->user->isSuperuser()) return true;
582+
$user = $this->wire()->user;
583+
if($user->isSuperuser()) return true;
569584
if(!$pagefile instanceof Pagefile) {
585+
$of = $page->of();
586+
if($of) $page->of(false); // false so that temp files are considered
570587
$pagefile = $page->hasFile(basename($pagefile), array('getPagefile' => true));
588+
if($of) $page->of(true);
571589
if(!$pagefile) return null;
572590
}
573591
$field = $pagefile->field;
574592
if(!$field) return null;
593+
if($pagefile->isTemp()) {
594+
// temporary file, just uploaded but not yet saved
595+
if(!$user->isLoggedin()) return false;
596+
if($page->id === $user->id) return $this->userFieldEditable($field, $user);
597+
return $this->fieldEditable($page, $field);
598+
}
575599
return $this->fieldViewable($page, $field, false);
576600
}
577601

@@ -606,6 +630,7 @@ class PagePermissions extends WireData implements Module {
606630
* in that language (requires LanguageSupportPageNames module).
607631
* - Optionally specify boolean false as first or second argument to bypass template filename check.
608632
* - Optionally specify a Pagefile object or file basename to check if file is viewable. (3.0.166+)
633+
* - Optionally specify array as first or second argument for options (3.0.244+ internal use)
609634
*
610635
* Returns boolean true or false. If given a Pagefile or file basename, it can also return null if
611636
* the Page itself is viewable but the file did not map to something we recognize as access controlled,
@@ -626,6 +651,7 @@ class PagePermissions extends WireData implements Module {
626651
$checkTemplateFile = true; // return false if template filename doesn't exist
627652
$pagefile = null;
628653
$status = $page->status;
654+
$options = array();
629655

630656
// allow specifying User instance as argument 0
631657
// this gives you a "viewable to user" capability
@@ -642,9 +668,15 @@ class PagePermissions extends WireData implements Module {
642668
// @todo: prevent possible collision of field name and language name
643669
$field = $arg0;
644670
$checkTemplateFile = false;
645-
}
671+
} else if(is_array($arg0)) {
672+
$options = $arg0;
673+
}
646674
}
647675

676+
if($arg1) {
677+
if(is_array($arg1) && empty($options)) $options = $arg1;
678+
}
679+
648680
if($arg0 === false || $arg1 === false) {
649681
// bypass template filename check
650682
$checkTemplateFile = false;
@@ -668,7 +700,7 @@ class PagePermissions extends WireData implements Module {
668700
$viewable = $this->processViewable($page);
669701
} else if($page instanceof User) { // && !$user->isGuest() && ($user->hasPermission('user-admin') || $page->id === $user->id)) {
670702
// user administrator or user viewing themself
671-
$viewable = $this->userViewable($page);
703+
$viewable = $this->userViewable($page, $options);
672704
} else if(!$user->hasPermission("page-view", $page)) {
673705
// user lacks basic view permission to page
674706
$viewable = false;

‎wire/modules/Process/ProcessPageView.module

Copy file name to clipboardExpand all lines: wire/modules/Process/ProcessPageView.module
+11-4Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,17 @@ class ProcessPageView extends Process {
147147
$originalPage = $page;
148148
$page = $request->getPageForUser($page, $user);
149149
$code = $request->getResponseCode();
150-
150+
$file = $request->getFile();
151+
152+
if($code == 403 && $file && $user->isLoggedin() && $originalPage->id === $user->id) {
153+
if($user->viewable($file, array('processName' => 'ProcessProfile'))) {
154+
// config.pagefileSecure is active and request is file for current user
155+
// allow file to be viewable if connected with user’s profile
156+
$code = 200;
157+
$page = $originalPage;
158+
}
159+
}
160+
151161
if($code == 401 || $code == 403) {
152162
$this->userNotAllowed($user, $originalPage, $request);
153163
}
@@ -171,7 +181,6 @@ class ProcessPageView extends Process {
171181
}
172182

173183
try {
174-
$file = $request->getFile();
175184
if($file) {
176185
$this->responseType = self::responseTypeFile;
177186
$this->wire()->setStatus(ProcessWire::statusDownload, array('downloadFile' => $file));
@@ -706,5 +715,3 @@ class ProcessPageView extends Process {
706715
$this->delayRedirects = $delayRedirects ? true : false;
707716
}
708717
}
709-
710-

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.