|
|
2022-06-21 08_49_57-Window.jpg (100,347 bytes) 2022-06-21 08_53_57-Window.jpg (61,808 bytes) 2022-06-21 08_57_55-Window.jpg (43,501 bytes) 2022-06-21 08_58_48-Window.jpg (30,561 bytes) |
|
|
On a test server we configured NTFS permissions on folder C:\Users for principal differently differently than the standard Microsoft rules (applied on all production servers). We omitted the traverse folder/execute file and List folder/read data NTFS permissions for this principal, and this gives us the expected behaviour/result the customer actually wants. However it seems not a good idea to tamper with standard NTFS rights as applied by Microsoft on a windows standard folder, can these NTFS permissions be applied in Scribus for the account used to show directory contents for the File Open option? (screenshots attached) 20220824_Scribus_C_users_result_productionserver.jpg (29,963 bytes) 20220824_Scribus_C_users_result_testserver.jpg (51,916 bytes) |
|
|
This not Scribus fault! " GPO is configured to limit access to C:\drive" This is not true! This setting only hides the drive, but not from users, but from explorer! Group Policy restrictions apply to the explorer file manager (file open window is also part of this API)! Scribus uses its own file management window, that's why hidden drives are visible in the file open window. Proposal: Don't hide the drives. You apply access restrictions to user groups (write, read, delete etc.) at the root drive level (C:, D: etc.). |
|
|
As already set the GPO settings applied limit both the access and the visibility of standard windows folders under C:\ Normally this is applied to limit access to 32bit and 64 bit program folders directory. However in remote desktop server setting every user logged on to the server has his personal (profile) folder under c:\users. A user can not access the user folder of another user so NTFS rights are already set correctly (as shown by screenshot attached). It is the visibility of other users folders that is the main concern here. Applying Access Based Enumeration (ABE) is not possible here as it concerns local non-shared drives, so SMB rights can not be applied. Standard windows explorer has the same issue, as show by screenshots attached on a test server where GPO settings are not applied (screenshot windows exporer and libreoffice draw). The only way to prevent this is by applying the GPO settings described above User Configuration>Policies>Administrative Templates> Windows Components/File Explorer Settings: Hide these specified drives In My Computer: Restrict A,B,C and D drives only Prevent Access to drives from My computer: Restrict A,B,C and D drives only This gives the error when using standard windows explorer or other applications as Libreoffice Writer (screenshots attached) This is not the case for Scribus (also screenshot attached). 2022-08-30 11_53_22-Window.jpg (157,282 bytes) 2022-08-30 15_31_54-Window.jpg (57,641 bytes) 2022-08-30 15_33_06-Window.jpg (50,817 bytes) 2022-08-30 15_39_15-Window.jpg (79,374 bytes) 2022-08-30 15_39_48-Window.jpg (32,778 bytes) 2022-08-30 15_43_03-Window.jpg (62,409 bytes) |
|
|
Scribus doesn't use native dialogs as pointed out. There's no ability within Qt to respect GPOs so we cannot follow this. |
- Anonymous
