WAC: Enable Web-Access-Checker by default

1 Requirements

Current Situation:

• ILIAS users can upload different types of files depending on their rights (e.g. learning modules, media files, photos, exercise, etc.)
• The files are not protected by default, i.e. they can be accessed anonymously
• Most administrators are probably not aware, that the files are not protected
• It is possible to configure a protection for these files (=web access checker), however it is not very easy and not enabled by default

• The web access checker or some equivalent protection should be enabled by default

2 Status

• This feature will be implemented as part of WAC: Redesign Web-Access-Checker.

3 Discussion

Is this information still up-to-date? http://www.ilias.de/docu/goto_docu_pg_15926_367.html
Does it make sense to integrate the configuration of the web-access-checker into the ilias setup in some form? If manual intervention in the apache configuration is still neccessary, the setup could display the current status of the configuration and maybe give a hint how to configure the web-access-checker.

JF 28 Apr 2014: We consider this being a feature request. Please add it to the 4.6 list, if being opened.

Jour Fixe 02 Feb 2015: We appreciate the feature request. Due to the current technical implementation it is not possible to enable the web access checker completely. Maybe this changes, since Uwe Kohnle and Oskar Truffer are currently working on a WAC: Redesign Web-Access-Checker. We should at least add this option to the setup, either as information text or if possible with an automatic check that tests the activation of the web access checker. We would prefer to include such an information and/or check on a new page in the setup that performs general checks for the installation (e.g. convert, zip). This page could be featured with a new main menu entry on the left (e.g. between List of Clients and Password).

4 Implementation

This features has been implemented by adding the new line

RewriteRule ^data/.*/.*/.*$ Services/WebAccessChecker/wac.php [L]

in the .htaccess-File. All other implementations are documented at WAC: Redesign Web-Access-Checker

Test Cases

Test cases completed at 28.08.2015 by Theodor Truffer

• http://testrail.ilias.de/index.php?/cases/view/6578 : C6578 Banner zum Blog hinzufügen und anzeigen
• http://testrail.ilias.de/index.php?/cases/view/6581 : C6581 SCORM Modul erstellen und Bild anzeigen
• http://testrail.ilias.de/index.php?/cases/view/6572 : C6572 Bild zum Poll hinzufügen
• http://testrail.ilias.de/index.php?/cases/view/6573 : C6573 Bild vom Poll aufrufen
• http://testrail.ilias.de/index.php?/cases/view/6579 : C6579 Banner zum Portfolio hinzufügen und anzeigen
• http://testrail.ilias.de/index.php?/cases/view/6556 : C6556 Media-Objekt hochladen und anzeigen
• http://testrail.ilias.de/index.php?/cases/view/6555 : C6555 Profilbild hochladen und anzeigen

Approval

August 25, 2015, Studer, Martin [mstuder]: Tested and approved by studer + raimann ag and iLUB Universität Bern