diff --git a/docs/en/04_Changelogs/3.1.9.md b/docs/en/04_Changelogs/3.1.9.md index aa4610b1e..81a452edf 100644 --- a/docs/en/04_Changelogs/3.1.9.md +++ b/docs/en/04_Changelogs/3.1.9.md @@ -5,18 +5,11 @@ ### File permissions This release makes an important change to File DataObject permissions in order to close a vulnerability in -file modification privileges. In 3.1.8 and below, any part of a website where user interaction could -potentially modify a file (such as an UploadField being used on the frontend) permissions may not be -adequately checked, meaning in some cases non-authorised (or even non-authenticated) users could -make changes to assets. This is because the File DataObject reports that any user has canEdit -privileges on it. +file modification privileges. By default the minimum necessary permission required by any user to modify files has been changed -to CMS_ACCESS_AssetAdmin. This permission value was historically required in 3.0 and has now been restored. - -In order to update a site to 3.1.9 it may be necessary to make sure that this permission requirement still makes -sense to any business logic, and it may also be necessary to apply another permission. This can be -done by creating an extension to File which applies the custom permission. +to CMS_ACCESS_AssetAdmin. If you need unauthenticated users, or users with other rights, to edit certain +files, then you will need to customise this. E.g. @@ -28,6 +21,10 @@ E.g. } } +An example use case is when you want to use UploadField on the frontend, where files could be uploaded +by non-admin users, and your above logic will need to ensure that those users can edit their own files +after they have uploaded it. + ## Security This release includes an important security fix.