divio/django-cms — pull request #1772 by Chive (2014-02-28 08:58:04+00:00)
Title: No support for file permissions.

When a file or other piece of uploaded media is added to a page/placeholder, there is no support for restricting access to the media.

I've implemented a view based on the use of Apache's mod-xsendfile, and while I wouldn't expect django-cms to deal with any of the header specifics, it'd be nice not to have to manually traverse through django-cms tables trying to work out whether a user is allowed to access a particular file...

At the moment I do something like this (assuming `path` is the url path component):

``` python
try:
f = CMSFile.objects.get(file=path)
if f.placeholder_id:
if f.placeholder.page:
cms_page = f.placeholder.page
if not cms_page.has_view_permission(request):
raise PermissionDenied
return ... # some code to work with mod-xsendfile
except CMSFile.DoesNotExist:
raise Http404
```

I'm not sure if there are other valid ways to have access to a given file, but this works for me.