Anonymous user access restriction to the master file does not work after migration to Atom 2.10.

[marcusmg...@gmail.com]

Hello,

I need help, because the anonymous user access restriction to the master file does not work after migration to Atom 2.10.

The masters files are in PDF.

Thanks.

[Johan Pieterse]

HI Marcus

Every master download goes through digitalobject/viewAction, which does QubitAcl::check($obj, 'readMaster') → forward404() if denied, then serves the file via nginx X-Accel-Redirect to an internal /private/… location. So an anonymous user with no readMaster should get a 404 - provided the request goes through the app.

Most likely cause after the migration: the web server is serving the digital-object files statically, so anonymous users fetch the master PDF by its raw /uploads/… URL and skip the ACL check entirely. Classic result of a regenerated nginx config during  the upgrade.

The 2-minute test (logged out): does the raw https://site/uploads/r/…/file.pdf URL download?
- If yes → web server is the problem → fix the nginx config (restore the internal /private/ location and stop serving masters directly).
- If no but the PDF still shows on the page → no reference derivative exists, so the viewer is showing the master itself → 

do if No: php symfony digitalobject:regen-derivatives.

Johan Pieterse

[Dan Gillean]

Hi Marcus, 

Unfortunately, at least part of this behavior is not a exactly bug in the traditional sense, and likely did exist prior to upgrade. In fact, making an exception for PDFs so that public users can access them is a known issue and was an early design decision made in AtoM. Please see this thread for more context, examples of other users from earlier versions of AtoM who also didn't notice the issue until upgrading, and a possible workaround if you do need to fully restrict access to your PDFs:

• https://groups.google.com/g/ica-atom-users/c/saLKpZs9DIs/m/RnB6NF0WBAAJ

At the time that thread was active, I had first proposed using the PREMIS Rights module as a way of restricting access - but it was discovered that there is in fact an actual bug in this case where PDFs still get the exception. Consequently, an issue ticket was filed, here: 

• https://github.com/artefactual/atom/issues/1724

The issue has unfortunately not yet been addressed, but I added a new comment referencing this thread to bump it and remind the AtoM team of the problem. In the meantime, I hope the other solution in the thread will help  you restrict access if needed. 

Cheers, 

Dan Gillean, MAS, MLIS
Business & User Experience Analyst
Artefactual Systems, Inc.
604-527-2056

he / him

--
You received this message because you are subscribed to the Google Groups "AtoM Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ica-atom-user...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/ica-atom-users/2878580f-5a00-4968-a6b9-1da494a06da4n%40googlegroups.com.