The reason why the file browser isn’t available is because it’s disabled for front-end use. Sucks for sure...but it’s better than having non-manager users accidentally deleting your files and images. Not only that but the file browser had to be modified so that it uses manager-only variables and thus wouldn’t work right on the front-end anyways without a manager session. Again, definitely sucks...but the good news is that we’ll be replacing the file browser with a better alternative that will allow for front-end use...at least that’s the goal. The current file browser is a bit old and really needs to be ditched.
Jeff
Jeff Whitfield
"I like my coffee hot and strong, like I like my women, hot and strong... with a spoon in them."
-
MODX Staff
- 12,272 Posts
The file browser used to function on the front end. Could that be re-enabled, dire-warnings understood?
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
Not without undoing the security fixes we added back prior to 0.9.5 coming out. Has alot to do with the config.inc.php file for the file browser script. If we skip the manager session then there’s the possibility of script injection. Guess we’ll need to look into it.
Jeff
Jeff Whitfield
"I like my coffee hot and strong, like I like my women, hot and strong... with a spoon in them."
-
☆ A M B ☆
- 711 Posts
I have a solution for this, I will try and publish it thsi weekend and how you can do it and still keep it secure.
Basically I’ve modded the websignup snippet so you can tell it to create a user asset folder i.e.
/assets/webusers/username
I’ve also tweaked fck to enable the browse button and point it to the webusers folder when a webuser is logged in, so now on one site ive done it on webusers can now upload flash, video, files, and images
Aaron.
-
☆ A M B ☆
- 453 Posts
And what could I do now?
I need to have an option so my webusers in certain group (ex. Editors) can upload pictures on server and put them in their news...
BASE - Web Design Studio
MODX Ambassador
Website
-
MODX Staff
- 10,725 Posts
Downgrading TinyMCE is definitely not going to help; the issue is with the MCPuk resource browser, not TinyMCE. Customize this at your own risk for the front-end. It’s a security risk to have those files even accessible to unauthenticated users, so make sure if you customize it, you properly secure it as well...
Okey, I could probaly convert my web users to manager users and use the ManagerLogin instead. The resource browser in front-end is a must.
So bottomline is... we must simply realize that the resource browser is dead and gone for the front-end and wait for a better solution?
