Image Thumbnails not visible when logged out
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	stexxen
	Sep 1 2014, 5:55 PM

Description

When creating a Task and attaching a local file via drag and drop, everything looks great for the creator.
But the attachments have been created with a 'Visible To' permission set only to the creator. So no one else can see it.

It's possible that this is as expected?, but from a users point of view, after creating a new task with attachments, they have to remember to then go back into Files and change the permissions of all the attachments that were added. But by that point the email to has already been sent to the assigned individuals and the Task is already visible to everyone.

Revisions and Commits

rP Phabricator
	D10428	rPb772a2b92af5 Reduce the cost of loading large numbers of macros
	D10412	rP3af442e4ac94 Don't require an actor in `PhabricatorFile::attachToObject()`
	D10411	rP8038af4bd570 Fix old image macros and memes for logged out users
	D10410	rP2e0361bd98c4 Bind file thumbnail visibility to the visibility of the original files

Event Timeline

stexxen created this task.Sep 1 2014, 5:55 PM

stexxen raised the priority of this task from to Needs Triage.

stexxen updated the task description. (Show Details)

stexxen added projects: Files, Maniphest.

stexxen updated the task description. (Show Details)

stexxen added a subscriber: stexxen.

stexxen updated the task description. (Show Details)Sep 1 2014, 6:06 PM

The file should also be linked to the task. You can see objects a file is linked to on the "Attached" tab of the file:

If you can view any of the objects a file is attached to, that should give you permission to view the file. You can click the policy link in the header for an explanation of this rule:

So the expectation is that attaching a file to a task (e.g., by embedding it with a comment) will let anyone who can see the task see the file.

If you're a little out of date and dragging the file into a custom field, you may be affected by a bug fixed in D10335.

chad added a subscriber: chad.Sep 1 2014, 6:23 PM

This comment was removed by chad.

In particular, I can see the file you uploaded just fine because I can see this task, even though the view policy is restrictive.

To make sure I understand, if I reiterate.
You need to make the file related to the Task to make it appear with the same permissions as the Task?

Currently the task is set to Public and the file was created with drag and drop (not created independently) and in a different browser which I am not logged in I see this

Ah, that looks like a bug with logged-out users and thumbnails. I'll look into it. That behavior is not expected.

chad renamed this task from When creating Tasks with attachments, the attachments have different permissions to the Task to Image Thumbnails not visible when logged out.Sep 2 2014, 8:35 PM

chad triaged this task as High priority.

I just noticed the problem doesn't occur if you log in and then log out. you can still see the images correctly
But you can make it occur by deleting your phabricator.com cookie.

In T6013#10, @epriestley wrote:

In particular, I can see the file you uploaded just fine because I can see this task, even though the view policy is restrictive.

This is now unrelated to the bug as described, but for Phriction this doesn't seem to work so well. Adding images to a wiki page doesn't create an "Attached" tab and the file is restricted to the user that uploaded the file (you need to manually change the file's visibility). Is this known/expected?

epriestley added a revision: D10410: Bind file thumbnail visibility to the visibility of the original files.Sep 4 2014, 3:03 PM