NEW: Added canAttachExisting config option for UploadField.

This is the companion setting to canUpload, letting you control whether existing files from the asset store can be referenced.  It's particularly useful when using UploadField on the front-end.

_config/uploadfield.yml

@@ -5,6 +5,7 @@ UploadField:
     autoUpload: true
     allowedMaxFileNumber:
     canUpload: true
+    canAttachExisting: 'CMS_ACCESS_AssetAdmin'
     previewMaxWidth: 80
     previewMaxHeight: 60
     uploadTemplateName: 'ss-uploadfield-uploadtemplate'

forms/UploadField.php

@@ -89,6 +89,10 @@ class UploadField extends FileField {
 		 */
 		'canUpload' => true,
 		/**
+		 * @var boolean|string Can the user attach files from the assets archive on the site?
+		 * String values are interpreted as permission codes.
+		 */
+		'canAttachExisting' => "CMS_ACCESS_AssetAdmin",
 		 * @var int
 		 */
 		'previewMaxWidth' => 80,
@@ -553,6 +557,7 @@ class UploadField extends FileField {
 	public function attach($request) {
 		if(!$request->isPOST()) return $this->httpError(403);
 		if(!$this->managesRelation()) return $this->httpError(403);
+		if(!$this->canAttachExisting()) return $this->httpError(403);
 
 		$return = array();
 
@@ -646,6 +651,11 @@ class UploadField extends FileField {
 		return (is_bool($can)) ? $can : Permission::check($can);
 	}
 
+	public function canAttachExisting() {
+		$can = $this->getConfig('canAttachExisting');
+		return (is_bool($can)) ? $can : Permission::check($can);
+	}
+
 }
 
 /**

templates/UploadField.ss

@@ -59,7 +59,10 @@
 			<% else %>	
 				<input style="display: none" id="$id" name="$getName" class="$extraClass ss-uploadfield-fromcomputer-fileinput" data-config="$configString" type="file"<% if $multiple %> multiple="multiple"<% end_if %> />
 			<% end_if %>
+
+			<% if canAttachExisting %>
 			<button class="ss-uploadfield-fromfiles ss-ui-button ui-corner-all" title="<% _t('UploadField.FROMCOMPUTERINFO', 'Select from files') %>" data-icon="network-cloud"><% _t('UploadField.FROMFILES', 'From files') %></button>
+			<% end_if %>
 			<% if not $autoUpload %>
 				<button class="ss-uploadfield-startall ss-ui-button ui-corner-all" title="<% _t('UploadField.STARTALLINFO', 'Start all uploads') %>" data-icon="navigation"><% _t('UploadField.STARTALL', 'Start all') %></button>
 			<% end_if %>

tests/forms/uploadfield/UploadFieldTest.php

@@ -512,6 +512,22 @@ class UploadFieldTest extends FunctionalTest {
 		$this->assertTrue($field->canUpload());
 	}
 
+	public function testCanAttachExisting() {
+		$this->loginWithPermission('ADMIN');
+		$response = $this->get('UploadFieldTest_Controller');
+		$this->assertFalse($response->isError());
+
+		$parser = new CSSContentParser($response->getBody());
+		$this->assertTrue(
+			(bool)$parser->getBySelector('#CanAttachExistingFalseField .ss-uploadfield-fromcomputer-fileinput'),
+			'Keeps input file control'
+		);
+		$this->assertFalse(
+			(bool)$parser->getBySelector('#CanAttachExistingFalseField .ss-uploadfield-fromfiles'),
+			'Removes "From files" button'
+		);
+	}	
+
 	public function testIsSaveable() {
 		$form = $this->getMockForm();
 
@@ -815,6 +831,10 @@ class UploadFieldTest_Controller extends Controller implements TestOnly {
 		$fieldCanUploadFalse->setConfig('canUpload', false);
 		$fieldCanUploadFalse->setRecord($record);
 
+		$fieldCanAttachExisting = new UploadField('CanAttachExistingFalseField');
+		$fieldCanAttachExisting->setConfig('canAttachExisting', false);
+		$fieldCanAttachExisting->setRecord($record);
+
 		$form = new Form(
 			$this,
 			'Form',
@@ -830,7 +850,8 @@ class UploadFieldTest_Controller extends Controller implements TestOnly {
 				$fieldReadonly,
 				$fieldDisabled,
 				$fieldSubfolder,
-				$fieldCanUploadFalse
+				$fieldCanUploadFalse,
+				$fieldCanAttachExisting
 			),
 			new FieldList(
 				new FormAction('submit')
@@ -847,7 +868,8 @@ class UploadFieldTest_Controller extends Controller implements TestOnly {
 				'ReadonlyField',
 				'DisabledField',
 				'SubfolderField',
-				'CanUploadFalseField'
+				'CanUploadFalseField',
+				'CanAttachExistingField'
 			)
 		);
 		return $form;