Permission for Media

[orchardbot]

@Piedone created: https://orchard.codeplex.com/workitem/19026

Currently there is no permission for Media, so anybody can manage media having permission for accessing the admin panel.

[orchardbot]

justrhysism commented:

This would be a brilliant feature.

[orchardbot]

@bleroy commented:

Don't we already have that? Shouldn't content permissions just work?

[orchardbot]

@Piedone commented:

Almost. There is one permission, ManageMediaContent, however:

• This permission is not checked on the front page of the Media Library and most of the actions of its AdminController are not authorized at all. I.e. there is no way to restrict access to the main admin page (the Media menu item will be hidden but nevertheless you can access the actions).
• While this permission is checked in some actions like when the preview infobox of an item is displayed when clicking on it and it is checked against the media item too it's not enough to restrict access to the item: this permission is not an dynamic content permission so you can either fully give it to a role or fully revoke it, no fine-grained access control.
• In conjunction with the previous point, ViewContent or EditContent permissions are not checked for media items in Media Library.

That said the full editors of items are indeed authorized since these go through the standard content admin.

[orchardbot]

@bleroy commented:

That's not what I was talking about. I was talking about content permissions, the feature that enables you to have fine-grained permissions on individual content items.

[orchardbot]

@bleroy commented:

Never mind, I understand what's being asked is a lot less granular.

[orchardbot]

@Piedone commented:

Would almost be fixed by: https://orchard.codeplex.com/workitem/19883