check if user has access to the default asset location

[i-just]

Description

When the assets field has a default assets location set, check if the user has permission to viewVolume before setting the defaultSource and defaultSourcePath template variables.

Please let me know if you need me to raise a separate PR for Craft 4.

Related issues

#13006

[brandonkelly]

This seems kindof at odds with these lines, which explicitly authorizes the user to access the upload folder, regardless of permissions:

cms/src/fields/Assets.php

Lines 638 to 639 in bff6946

	$folder = $this->_uploadFolder($element, false);
	Craft::$app->getSession()->authorize('saveAssetInVolume:' . $folder->getVolume()->uid);

Maybe that’s just not working as intended currently?

[i-just]

I tracked it down to enforcing defaultSourcePath for Element Index.

In 3.7, it worked as expected. The defaultSource was still set to what’s defined in the field’s settings, but it was then “ignored” in favour of showing the volume user has permission to view. If a user didn’t have permission to view any volumes, they could see the field in the entry layout but not modify it.

In 3.8, the defaultSource and defaultSourcePath are enforced even if a user cannot view the volume those two reference. It then caused the criteria for the element query to contain a folderId for an unpermitted volume. PHP side of things works roughly the same, but because of this: https://github.com/craftcms/cms/blob/v3/src/web/assets/cp/src/js/BaseElementIndex.js#L306, the defaults were enforced regardless of permissions.

I reverted the previous change and committed a new fix.