You need to be logged in to post in the forum - Log In

An active JCE Pro Subscription is required to post in the forum - Buy a Subscription

Support is currently Offline

Official support hours
Monday to Friday
09:00 - 17:00 Europe/London (BST)

Please create a new Ticket and we will get back to you as soon as we can.

#117273 Front end vs Default media permissions

Posted in ‘Editor’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Latest post by tskipton on Wednesday, 30 July 2025 17:02 BST

tskipton

Hi, 

I uses Joomla Shack Article Manager Pro to allow my subscribers access to create and edit articles from the front end.  I have JCE Pro installed as my default editor.  I want the users to be able to upload and use their own media, but not access other users media on the site.

I have the Default profile set up for Front-end and Back-end, Super User User Group only.  Under Features & Layout I have the Additional Features File Browser and Media Support.

I have the Front End profile published set up for Front-end, Author, Editor, Publisher, Subscriber.  Under the Features & Layout I have the Additional Features File Browser and Media Support unselected.  However, when I log on using a subscriber ID I still see the Media option listed below the editor panel and selecting it provides the option to look at any of the Joomla User directories besides their own.   Is there anyway to secure this behavior 

 

 

Attachments

Ryan

However, when I log on using a subscriber ID I still see the Media option listed below the editor panel and selecting it provides the option to look at any of the Joomla User directories besides their own. Is there anyway to secure this behavior

You can disable the Joomla editor-xtd buttons below the editor, including the Media button, in one of 2 ways:

Per profile - In Editor Profiles -> Features & Layout, set Show Editor-xtd Buttons to No.

Globally for all users - Go to System -> Manage -> Plugins, click on  Filter Options, and select editors-xtd from the Type list. Select the buttons to disable and click the Disable button. You can also edit each button indivudally and set the Access level for it, eg: Super Users.

Ryan Demmer

Lead Developer / CEO / CTO

Just because you're not paranoid doesn't mean everybody isn't out to get you.

tskipton

Thanks,  that resolved that issue.  I'm trying to limit access to only that user's directory.  I have the File Directory path set to images/users/$username but this allows the user to back up to the images/users directory.   I tried setting the directory filter to +images/users/$username, but this doesn't seem to have helped.  Is there any way to lock this down? 

Ryan

I'm trying to limit access to only that user's directory. I have the File Directory path set to images/users/$username but this allows the user to back up to the images/users directory. I tried setting the directory filter to +images/users/$username, but this doesn't seem to have helped. Is there any way to lock this down?

Do you have more than 1 profile active? If the profile order is incorrect, the user might be accessing a different profile than the one intended. 

Please send me a login - https://www.joomlacontenteditor.net/contact/site-login

Ryan Demmer

Lead Developer / CEO / CTO

Just because you're not paranoid doesn't mean everybody isn't out to get you.

Ryan

I have the File Directory path set to images/users/$username but this allows the user to back up to the images/users directory.

I assume you mean via the Images & Links tab, with the Intro Image and Full Image fields?

Enabling the File Browser option in the Features & Layout tab of the Editor Profile will convert these fields to the use the JCE File Browser, enforcing the File Directory Path restrictions. I have done this on your site for the Front-End profile.

Ryan Demmer

Lead Developer / CEO / CTO

Just because you're not paranoid doesn't mean everybody isn't out to get you.

tskipton

Thank you so much for fixing my problem and explaining it to me.  I kind of shot myself in the foot.  I had this item selected, but thought that what was causing my problem was when I published the front_end profile.

I appreciate your help and continued support.

This issue can be closed