From cholena at mammothgeospatial.com  Wed Apr 16 23:47:20 2025
From: cholena at mammothgeospatial.com (Cholena Smart)
Date: Thu, 17 Apr 2025 14:47:20 +0800
Subject: [GeoNode-users] Assets and permissions
Message-ID: <CABcS0wMFz7i4jOxBfEMK1GJrmRTVsYNYTrCDO6D=r6Sw31TXRQ@mail.gmail.com>

Hi,

I've noticed that the new Assets tab allows downloading the original
uploaded dataset file, even when the resource permissions I've set should
restrict access. For example, if I only grant view permission to anonymous
users, they can still download the data via the Assets tab (and also
through the API).

Is there a way to make the Assets respect the same permissions set on the
resource? Have I missed something in my configuration?

I'm using dockerised GeoNode 4.4.1 (tested in 4.4.2 also).

Thanks,
Cholena
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/geonode-users/attachments/20250417/796a4dc2/attachment.htm>