I'm facing a challenge with file access control in TYPO3, and I'm hoping to get some guidance or suggestions from the community.
Problem:
I need to implement a file access control system in TYPO3 where users have access to specific folders based on their individual permissions. I'm using the sr_feuser_register extension to create front-end user accounts, and I have modified it to automatically create a folder for each new user (see code below). Now, I want to grant each user read access only to their respective folder.
What I've tried so far:
I've explored the built-in user group functionality in TYPO3, but it only allows me to assign access permissions at the group level, rather than at the individual folder level.
I've researched available TYPO3 extensions such as secure_downloads, fal_securedownload etc. but none of them seem to provide the exact functionality I need.
Desired Solution:
I'm looking for suggestions, guidance, or alternative approaches to achieving fine-grained file access control in TYPO3. Specifically, I want to grant each user read access to their own folder while restricting access to other users' folders. The goal is to upload files to the fileadmin location which the frontend users then can access through their login credentials.
I'm currently using TYPO3 version v11.5.22 without composer mode and the sr_feuser_register extension to manage user registration. Ideally, I would like to integrate a solution that works seamlessly with these components.
I'm open to any custom solutions or utilizing third-party extensions if they provide the required functionality.
Any help or insights on this matter would be greatly appreciated. Thank you in advance!
Here is the code that i added to the CreateActionController.php of the sr_feuser_register extension to create the custom folders in fileadmin (i can provide the full code if needed):
<?php
namespace SJBR\SrFeuserRegister\Controller;
//....classes
/**
* Create action controller
*/
class CreateActionController extends AbstractActionController
{
/**
* Processes the create request
*
* @param array $dataArray: array of form input fields
* @param string $cmd: the command
* @param string $cmdKey: the command key
* @return string the template with substituted markers
*/
public function doProcessing(array $finalDataArray, $cmd, $cmdKey) {
//......
// Set the time zone
date_default_timezone_set('Europe/Berlin'); // Replace 'Europe/Berlin' with your desired time zone
// Get the current date
$currentDate = date('ymd');
// Prepare the folder name
$firstName = $finalDataArray['first_name'];
$lastName = $finalDataArray['last_name'];
// Convert special characters to ASCII equivalents
$firstName = iconv('UTF-8', 'ASCII//TRANSLIT', $firstName);
$lastName = iconv('UTF-8', 'ASCII//TRANSLIT', $lastName);
// Replace umlaut characters with their ASCII equivalents
$firstName = str_replace(['ä', 'ö', 'ü', 'ß'], ['ae', 'oe', 'ue', 'ss'], $firstName);
$lastName = str_replace(['ä', 'ö', 'ü', 'ß'], ['ae', 'oe', 'ue', 'ss'], $lastName);
// Remove non-alphanumeric characters
$firstName = preg_replace('/[^a-zA-Z0-9]/', '', $firstName);
$lastName = preg_replace('/[^a-zA-Z0-9]/', '', $lastName);
// Check if the first name and last name are not empty
if (!empty($firstName) && !empty($lastName)) {
// Construct the folder name
$folderName = $currentDate . '_' . strtolower($lastName) . '_' . strtolower($firstName);
// Create the folder path
$folderPath = 'fileadmin/data/' . $folderName;
// Attempt to create the folder
if (mkdir($folderPath, 0755)) {
// Folder created successfully
// Set folder permissions
chmod($folderPath, 0755); // Adjust the permissions as needed
// Get the FE user UID
$feUserUid = $GLOBALS['TSFE']->fe_user->user['uid'];
// Set folder access rights for the FE user
$feUserUid = $GLOBALS['TSFE']->fe_user->user['uid'];
// Get the FE user group ID
$groupId = $GLOBALS['TSFE']->fe_user->user['usergroup'];
// Get the TYPO3 database connection
$databaseConnection = GeneralUtility::makeInstance(\TYPO3\CMS\Core\Database\ConnectionPool::class)->getConnectionForTable('sys_file_metadata');
// Clear any existing folder permissions for the patient's folder
$databaseConnection->exec_DELETEquery(
'sys_file_metadata',
$databaseConnection->quoteIdentifier('table_local') . ' = 1 AND ' .
$databaseConnection->quoteIdentifier('identifier') . ' = ' . $databaseConnection->quote($folderName)
);
// Grant folder permissions to the FE user group for the patient's folder
$databaseConnection->insert(
'sys_file_metadata',
[
'uid' => $groupId,
'table_local' => 1,
'identifier' => $folderName,
'permissions' => 31, // Set desired folder permissions (e.g., 31 for full access)
'modified' => time()
]
);
}
}
//......
}
}
