#2574 - Previous avatar permission issue

This is a spacer post for a website comment topic. The content this topic relates to: #2574 - Previous avatar permission issue
It's an interesting idea, but I'm going to drop it due to the complexity it would add to the engine.

We'd need to have a new database table tracking who owns on-disk files. Otherwise by associating to them you could essentially take control of someone else's files, and delete them with a resource delete (potentially anyway). Or, maybe at some point we add an image editor, and you'd be able to edit other people's files.

Maybe that could be worked around by detecting truly orphaned files, but that's dicey given how WYSIWYG can often bypass our upload management.

We'd also need some option to say whether files are left around when replacing uploads or deleting resources. Currently they are only around because the privilege to have them auto-deleted is not there - admins would therefore not benefit, without all this extra work.
0 guests and 0 members have recently viewed this.