[TYPO3-dev] FAL and EnableFields - suggestion for improvement

[Frans Saris]

Hi André,

We took a slightly different approach for using the fe_group field to
secure files in fe.

See http://typo3.org/extensions/repository/view/fal_securedownload and
https://github.com/beechit/fal_securedownload. It uses the current FAL API
mostly with some additions to determine if a user has the correct
permissions when accessing a file.

Gr. Frans
 Hello,

in a fresh installation of TYPO3 CMS 6.2 there are no enable fields in FAL.
This makes sense for most use cases.
But even the system extension filemetadata adds a field fe_groups. But only
db table and TCA is changed.
So if use USE this system feature and expect it is already included, you
get wrong.

Looking into the file repository this gets clear.
Method \TYPO3\CMS\Core\Resource\FileRepository::findByRelation() calls
enableFields() for table sys_file_reference, but not for sys_file_metadata.
Adding this here would mean to add a third table here in the SELECT
statement and an additional relation to be resolved. Due to performance
reasons this should be avoided.
But what about introducing a signal here?
Just between compiling the SELECT statement and executing it?
In system extension filemetadata there could be added a slot then to extend
the query to check the enable fields of the metadata.

At the moment this system feature (fe_groups) is nearly useless. If you
need to check access restrictions on file level, you have to fetch all
records by a sql query first. As enableFields just returns the finally
where clause, you have to build up the list of groups for youself and run
with php through all entries by checking them. And don't forget to discard
unneeded entries to reduce memory usage. Perhaps at the and there is no
single entry at all, but you have executed a lot of php code and used a lot
of memory...

Regards,
André Spindler
_______________________________________________
TYPO3-dev mailing list
TYPO3-dev at lists.typo3.org
http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-dev