ManageOwnMedia allows the user to manage other's media

[MikeAlhayek]

Describe the bug

I want users to be able to manage/see their own media only. I granted them ManageOwnMedia permission, but they are still able to list and manage all the media.

Expected behavior

When a user only has ManageOwnMedia, they should only be able to list, edit, delete media that was originally uploaded by them

@jtkech we have ManageMediaFolderAuthorizationHandler which handles permission for folders to a given path. But, I do not see anywhere were we provide path name as a resource and we do ManageOwnMedia check against the file owner.

I also don't think we store media meta info as in who uploaded the file. Do we store this info anywhere "storage meta" or database?

[hishamco]

I think this is a known issue, I'm not sure if @agriffard or @sebastienros remember it

[sebastienros]

After looking at existing PRs and issues related to that, we might just need to change the handler to grant ManageMedia when the user has ManageOwnMedia and the destination folder is the user's folder. The handler might then require the destination media (or folder) to provide this.

[gvkries]

As we closed #15159 as a duplicate, should we also close this for this in favor of the even older issue #12057?