Web-based file browser with finely tuneable access control

Question

I have a server running Ubuntu 12.04 which I use, among other things, as a place to store and back up a lot of data. To keep the scope of the question narrow as possible, let's consider only photos. I find it convenient to keep the photos in a directory structure such as

Photos\2005.06.30 - Bens Birthday
       ... (about 200 folders or so)
      \2015.03 - Vacation

The point is, that I do not intend to alter in any significant way this folder structure and there's already quite an amount of folders there too.

Initially, from the /var/www directory I set up a symlink to the directory with the photos and used htaccess to restrict access to specific users registered on this server. Anyone who knew a username/password pair could go to http://hostname/Photos, type in the user-pass and see a list of directories and files to click through.

Now that I want to share some of these photos, I turned to applications such as owncloud and pydio. They have a really nice interface with thumbnails 'n'all, they let you download an entire directory as a zip-archive and all would be great, however...

Both when using plain old browsing, and when using owncloud or pydio, you get access to anything that the user www-data has access to. Without owncloud or pydio if I want to grant someone access to only a specific subdirectory in Photos I must code a separate rule in the config of apache for that directory. Otherwise I get a situation where someone can either see everything, or nothing at all.

Unfortunately, owncloud and pydio have the same problem. For example, pydio has the concept of shared workspaces, so I create a shared workspace consisting of the Photos directory. Unfortunately, you can only share this workspace as a whole. What I cannot do, is select individual directories in Photos and specify "this will be accessible to everyone, this just to my parents, this here, this there" and so on. So again, I'm stuck with the need to create a separate workspace for every group of photos. It gets worse, because I might have a directory like Photos\Photos from Egypt\ which I'm willing to share, and then within it a directory like Photos\Photos from Egypt\Hot porn with wife\ which should be accessible just to me and my wife. If I create individual workplaces for every subdirectory, the directory structure is lost.

I imagine, this is due to the backwards nature of owncloud and pydio with respect to what I'm trying to achieve. While these apps offer a cloud service for several users, where everyone has his own private space, I'm trying to selectively share some of my data with a certain group of users. I'm not aiming to offer them cloud storage services.

An ideal solution for me would be one, where I could set the ownership of the files and folders to certain users and groups and have a web-based service mimicking an SFTP client that would respect these ownerships. So someone could log on as userjoe from group notmanyrights and browse the Photos directory only getting access to, say, those subdirectories where the access rights are 755, but not, say, 750.

Quite important for me is the ability to download entire directories in one click and have thumbnail view of the photos in a subdirectory.

Answer 1

I think I found a solution which is relatively simple to maintain. I was afraid of running into bugs and having to resort to the suggested-in-comments Alfresco, but the first very quick test shows wonderful results.

Considering the number of users will be quite small and only I should be doing the administration, this will work for me.

1. Install Pydio.

2. run cp -rs /my/path/to/Photos/ ~/symlinks/. This will recreate the entire tree structure of the Photos directory, except instead of files there will be symlinks. So now I can copy this structure to /var/www/pydio/data/personal/username/ for every user and delete those symlinks that link to the photos the user should not see.

3. Maintain a recent version of the structure with symlinks is a one-line command, as new photos are added, I can manually add the relevant subfolders to the users' directories being as selective as necessary.

4. This is in part even better than unix user:group format, as it works as a full access control list.

5. Group permissions, rather than individual user permissions are possible by taking a similar approach with shared workspaces in Pydio.