[RNMobile] Remove upload options for users who lack upload permission #39769
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mchowning
added
the
Mobile App - i.e. Android or iOS
|
Size Change: 0 B Total Size: 1.21 MB ℹ️ View Unchanged
|
Closed
2 tasks
This was referenced Mar 28, 2022
Closed
SiobhyB
reviewed
Apr 1, 2022
There was a problem hiding this comment.
@mchowning, after looking into how this is handled on the web side, I'm a bit unclear around whether contributors should be able to access and pick images from a site's Media Library.
I found, as per the following screenshots, that contributors can't access a site's library from the web's admin area. The "Media" option is hidden from the sidebar on both .org and .com:
| .org site | .com site |
|---|---|
 |
 |
When attempting to add a Gallery or Media & Text block, a To edit this block, you need permission to upload media. error is displayed:
While the Image and Audio blocks simply show an option to add via URL (working to embed media, rather than upload it):
Although it clearly seems that contributors are able to access and upload via the Media Library on an API level, I'm not sure if we should be allowing for that through the app if it's not done on the web. There could be a scenario where a site owner doesn't realise that there's a way for contributors to access their site's Media Library (given they can't on the web) and view it as a breach of privacy if they discover it's possible via the app.
Then again, we do already allow contributors to access the Media Library via the app's sidebar, so it feels like there's a wider discussion to be had.
For this PR, my gut feeling is that we should probably match up with the way the block's work on the web and not allow uploading via the Media Library.
Interested to hear your take on this, wdyt?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related PRs:
What?
Fixes wordpress-mobile/gutenberg-mobile#3259 by removing upload options from the media blocks for users who do not have permission to upload to a site (i.e., Contributors).
Why?
Prevents users from being given the option to upload a file when that upload will always fail due to their lack of permission to upload to the site.
How?
The upload permission for the user is passed up from the native apps and if the user does not have an upload permission, they are only allowed to select media already in the site's media library.
Testing Instructions
Please perform the following tests on both WPAndroid and WPiOS since there are native changes on both platforms.
1. On dotcom Site Where the User is only a Contributor
On dotcom Site Where the User is an Editor/Admin (i.e., can upload)
Add an image block and verify the following options for adding media
Add a video block and verify the following options for adding media
Add a file block and verify the following options for adding media
Add an audio block and verify the following options for adding media
2. On a self-hosted Site Where the User is an Editor/Admin
Perform the same checks listed under "On dotcom Site Where the User is an Editor/Admin".
Note that even if the user is only a contributor, they will still have all the upload options on a self-hosted site because we do not have user role information for self-hosted sites in the app currently, so we just treat everyone as having permission as the default.
3. On a dotcom FREE Site where the User is an Editor/Admin
Screenshots
Note that the two sites I'm using have different themes, so the colors are different.
Image Block
Video Block
File Block
Audio Block