Drupal media access control should be the same as the referencing content node access and privacy settings
- Drupal media library permissions node content permissions
- if my content is private make media private Drupal
In the new version, we would like to have this fixed so that folks can add things from the media library (assuming that they can only see files associated with content items that have not be designated as private). Do content permissions sync with file permissions?
There are two additional layers of access after the content:
- Passing on the content item (node)’s permissions to the media item.
- Preventing access to the actual file if someone does not have access to the media item.
Note that the equivalent to 2 is not a feature of many current sites— if you can guess a path to the file, you can see it. So only addressing 1 here, for now. (Once the media access is controlled, addressing 2 is a matter of enabling and using private files. More here Make Media Library work with private files ? and here, plus an issue about documenting supporting private files for media).
- [Media Private Access](https://www.drupal.org/project/media_private_access) does this with its Media permissions "Inherited from immediate parent" access mode, but is aggressively labeled experimental— still, if it works that may be the most straightforward solution and we can seek co-maintainership of the module.
- The core issue, [Make private file access handling respect the full entity reference chain](https://www.drupal.org/project/drupal/issues/2904842), has no patch to fix it (the old patches are only about adding a warning), but [suggests a workaround](https://www.drupal.org/project/drupal/issues/2904842#comment-13942052) by the module providing the original access control, Permissions by term, to also do access control for the associated media entities.
One one set of sites we have it is certainly worth filing an issue with [Access Policy](https://www.drupal.org/project/access_policy) module that we are already using. It already [supports multiple entity types](https://www.drupal.org/project/access_policy/issues/3421025) including (it seems?) media. There may already be a way to configure the module to do this, or the feature may be readily embraced by the amazingly responsive maintainer.
Or, as an issue closed as duplicate put it: Access to files attached via media entities should be ultimately controlled by the published state of related content
- Conclusion for this particular site ([[PECE]]) was that nothing would go in the media library, so ultimately it was easier to have image and video fields directly on the content, on nodes, although we do have concerns that some video features only exist in the special sauce of core Drupal media.
- re-research tab dump:
- entity browser for video media type drupal at DuckDuckGo
- Media Entity · Drupal 8 Media Guide
- Media library vs entity browser - Drupal Answers
- 8 - Entity Browser Widget for Video Embed Media Entity - Drupal Answers
- Issues for Media Entity Browser | Drupal.org
- media video duration field automatic drupal at DuckDuckGo
- REST view - get duration of video (Media content field) | Drupal.org
- Your Definitive Guide to Using Drupal’s Media and Media Library | Drupal Sun
- Media Documentation · Drupal 8 Media Guide
- Video Embed Field | Drupal.org
- Duration Field | Drupal.org
- drupal private files with media at DuckDuckGo
- Media Private Access | Drupal.org
- A content editor can add an analytic to multiple structured analytics (question sets) · Issue #359 · PECE-project/drupal-pece
- drupal private files and large files like videos - Google Search
- Does anyone have images working using private folder and path? [SOLVED] | Drupal.org
- Accessing files outside the Drupal directory tree | Drupal.org
- How to secure a private file in Drupal | Rootstack
- Videos not playing with link to private filesystem (uploaded manually) [#2214135] | Drupal.org
- Drupal 8 : Serving private files using nginx and X-Accel-Redirect - Drupal Answers
- Extra work load with private files system ?? | Drupal.org
- Video Files Storage | Drupal.org
- Controlling access to private files | Drupal.org
- Drupal private file mystery – who has access? | bryanmanalo.com
- How to Secure Private Files in Drupal: Tips for Safely Configuring Your File System | Adrian ABABEI - Drupal Developer
- Private and Public File Management | Drupal.org