[OrchardCore.Media] non-admin user can not upload pictures

[scil]

I have succussivly made admin upload pictures by ajax to /Admin/Media/Upload.

but a normal user can not, getting response <h1>You do not have access to this resource.</h1>.

I have allocated all permissions to the role which the users belongs to

If I add admin role to this normal user, then the user can upload picures.

---

the related action maybe is OrchardCore.Media/Controllers/AdminController::Upload

        [HttpPost]
        [MediaSizeLimit]
        public async Task<ActionResult<object>> Upload(
            string path,
            string contentType,
            ICollection<IFormFile> files)
        {
            if (!await _authorizationService.AuthorizeAsync(User, Permissions.ManageMedia))
            {
                return Forbid();
            }

         ....

how could I debug it?

[scil]

now I found that I have to add another permission Access admin panel with id AccessAdminPanel.

Is it safe to grant this permission to all Authenticated usrers ?

is there any way to skip verifying this permission ?

[hishamco]

Normal users are not allowed to manage the media, that's why you got an error. If you need the users to upload some documents or images you can use Workflow to do this in their behalf

[scil]

normal user should be allowd to upload media

[hishamco]

If they have a manage media permission, they can do unexpected things ;)

[scil]

uploading media should not require admin permission. do i have be admin to upload img to github issues/dicussions?

[ns8482e]

@scil if you are giving a permission to a room within a building then you also need to give a permission to enter in the building

So yes you need to give permission for AccessAdminPanel as Media app resides inside the admin

[hyzx86]

@scil 兄嘚，快到群里来QQ: 877196442

[scil]

a recipe to grant necessary permissions to allowe users to upload files

migration.recipe.v3.Permissions.upload.json

{
  "name": "",
  "displayName": "",
  "description": "",
  "author": "",
  "website": "",
  "version": "1",
  "issetuprecipe": false,
  "categories": "",
  "tags": [],
  "steps": [
      {
          "name": "roles",
          "Roles": [
              {
                  "Name": "Authenticated",
                  "Permissions": [ "AccessAdminPanel", "ManageMediaContent","ManageOwnMediaContent" ]
              }
          ]
      }
  ]
}

Migrations.cs

        public async Task<int> UpdateFrom2()
        {

            await _recipeMigrator.ExecuteAsync("migration.recipe.v3.Permissions.upload.json", this);
            return 3;
        }

[scil]

Now for security, I copied src/OrchardCore.Modules/OrchardCore.Media/Controllers/AdminController.cs and changed the permission required for action Upload.

It's redundant. the best way is to change OrchardCore.Media , removing the admin-related permission requirement