User media library access permissions are invalid for new media librar

[thsrite 2]

New user A has been added, and access permissions to some media libraries have been assigned to user A.

Then media library B was added, and by default, user A did not check access to media library B. But user A can search for or see the content of media library B through recommendations from other media. This makes user A's access to new media library B invalid.

However, without any modifications, go to the configuration page of user A and click save. User A is unable to search for media in new media library B.

It is speculated that when adding media library B, the accessible media library permission table for user A was not updated simultaneously.

You can test it, my server version is 4.9.0.16. I didn't save the log. After testing, it was easy to reproduce the problem.

 

[Luke 37256]

HI there, can you please provide a specific example? thanks.

[thsrite 2]

@Luke

1.Firstly, I created a new user and assigned media library permissions, as shown in the figure

2.I have created a new media library called "test", which contains a movie

3.Returning to the user media library permission settings page, please note that I did not click save here. Just to express that I don't have access to this media library checked!

4.This user login in to EMBY and searches for the aforementioned movie, which can be found!

You can also see the resources of this media library in the media recommendations on the media details page of other media

5.Returning to the user media library permission settings page, without making any changes, click save.

6.If you use the user to search for the above movie again, they won't be able to find it!

Speculation: If the user has configured media library permissions beforehand. The newly added media library in the future is unchecked by default, but the resources of the library can also be accessed by searching for it (the resources of the library can also be seen in the media recommendations on the media details page of other media).

Edited May 6 by thsrite

[thsrite 2]

In the scenario where access to all media libraries is not enabled and user media library access permissions are customized.

In this scenario, when creating a new media library, the user's media library permissions default to the unselected state.

So, was there no record of adding user media library permissions when creating a new media library?

Edited May 6 by thsrite

[Luke 37256]

On 5/5/2024 at 11:13 PM, thsrite said:

In the scenario where access to all media libraries is not enabled and user media library access permissions are customized.

In this scenario, when creating a new media library, the user's media library permissions default to the unselected state.

So, was there no record of adding user media library permissions when creating a new media library?

Hi, we've actually always done this. What if it was an adult library? You may not want all users to see it. That's why you need to grant them access.

[thsrite 2]

1 minute ago, Luke said:

Hi, we've actually always done this. What if it was an adult library? You may not want all users to see it. That's why you need to grant them access.

but i found this problem. please check it

[Luke 37256]

17 hours ago, thsrite said:

but i found this problem. please check it

@sa2000are you able to reproduce?

[Happy2Play 8356]

20 minutes ago, Luke said:

@sa2000are you able to reproduce?

Yes 4.8.6.0

Create a user with limited access/no access.

Log in as admin

Add a new library with whatever, allow scan to finish

login with restricted user and search for newly added item it shows up. (but you obviously have to know what items exist as the library does not show up in My Media.)

Search Suggestions also provide links to resticted content also.

Any actual access can show items in more like this that are restricted.

 

Now allowing user access to library and doing scan library shows for user.  And removing access from that library now properly restricts that content.  But other loopholes above still exist but am no longer able to search or see my test file.

 

[sa2000 19]

14 hours ago, Luke said:

are you able to reproduce?

As Happy2Play stated, adding new library is accessible to the user that was created with no access to any library

So Home view shows no libraries

But Search actually gave me a clue what to search for. I added a music library with album for Carly Simons and when clicking on Search, a suggestion to search for Carly Simon appeared

And you can Search for the artist or album name or track name and they all succeed

For existing libraries the search only returns people results but no media files returned

So for existing libraries the only loophole is for people search. You can search for people names but not the movie titles/tv titles etc. New libraries are fully accessible in search results 

 

[Luke 37256]

On 5/8/2024 at 5:55 PM, Happy2Play said:

Yes 4.8.6.0

Create a user with limited access/no access.

Log in as admin

Add a new library with whatever, allow scan to finish

login with restricted user and search for newly added item it shows up. (but you obviously have to know what items exist as the library does not show up in My Media.)

Search Suggestions also provide links to resticted content also.

Any actual access can show items in more like this that are restricted.

 

Now allowing user access to library and doing scan library shows for user.  And removing access from that library now properly restricts that content.  But other loopholes above still exist but am no longer able to search or see my test file.

 

After you get to this point:

Quote

And removing access from that library now properly restricts that content.

What loophole still exists after that?

[Happy2Play 8356]

9 hours ago, Luke said:

After you get to this point:

What loophole still exists after that?

Will look some more but Search suggestions link to none access items.  Looks like it might be limited to Artists, all Artist/People are all searchable to but with no items.  But primarily have only tested with tag restrictions as it is the easiest variable to restrict/allow.

 

Empty Tags are still shown and are searchable

Collections, Genres and Studios searchable but empty

From a playable content I have not really found a method

 

 

 

 

[BruceThomas 0]

I can confirm that this is happening to me as well in 4.8.5. It's crazy when kids are searching they can find our R movies library, thus I can't give the kids access.

Create a libraries "G Movies" and "R Movies".

Create a 'child' user where there is no access to any library.

Grant 'child' access to "G Movies" library specifically - not any other library.

The 'child' user can go in and search for parts or exact names of movies in the "R Movies" and it comes up with previews and everything. They can even click play! 

This is a HUGE loophole if you want to have family access - which seems like a reasonable goal.

Your search indexes and queries need to be parameterized with library access. I can't see this being a problem technically, even if there are 100's of libraries (which seems like an abuse of emby at that point) this should be performant. 

Edited May 13 by BruceThomas

[sa2000 19]

1 hour ago, BruceThomas said:

I can confirm that this is happening to me as well in 4.8.5. It's crazy when kids are searching they can find our R movies library, thus I can't give the kids access.

Create a libraries "G Movies" and "R Movies".

Create a 'child' user where there is no access to any library.

Grant 'child' access to "G Movies" library specifically - not any other library.

I have not been able to reproduce this on 4.8.6

However, if the libraries were added after the user is setup then they are accessible.

If the libraries already existed and then a user is added and access set, then the movies do not come back in search results.

There is an issue with search and results for artists, people and genre where these get returned but not the actual media items.

And if new libraries are added then the existing restricted users will have access to the new libraries.

There may also be a specific issue with music but that could be the same bug as that for artists being in search results

 

cc @Luke

[Luke 37256]

OK thanks. This should all be good now in the beta channel and the fix will be in 4.8.7. Thanks.

[Happy2Play 8356]

Please retest your scenario.

 

This specific issue appears resolved in 4.8.7.0 in my tests.

Still issues with People/Artists/Genre all searchable (but no linked data).  Tags can show up empty via library.

Depending on restriction feature used as tag restrictions will show Empty libraries.