[4.0] Media Manager ACL additions

[schnuti]

Is your feature request related to a problem? Please describe.

I had a look in the code after reading "the other issue" and found a couple of "should be" issues.

Describe the solution you'd like

The Upload and Create New Folder should be separated (new ACL Value -> Create Folder)
The Edit screen should be protected with ACL, at least the Toolbar (new ACL Value -> Edit)
The Javascript Buttons should be disabled according to ACL settings for Edit. i.e. no image edit, no file- /foldername change, (no download??)

The image is from the Modal in frontend article edit with Delete disabled with ACL.

[brianteeman]

Create Folder
Delete Folder
Edit Folder
Create Image
Delete Image
Edit Image

Is that the list of permissions you are suggesting

[schnuti]

My suggestion was not that fine graded but in principle yes.
e.g. a certain user group should be able to upload an image (=create) but not create folders, edit any image/folder or delete anything. Specifically in the frontend modal Select Image. An Edit Own is of course not possible on file level.

[brianteeman]

I think it needs to be that fine grained to achieve what you want

[schnuti]

Fine grained not really needed but logically better not to mix items with folders at all.
What about Download? I guess it should be allowed as it's more or less impossible to hide images from the public anyway. I'll add some more about this in another proposal .

As I have no clue about the Javascript used by the Media Manager, I'm not able to make a PR. If the Javascript buttons can't be disabled or hidden anyway, I could probably fix the PHP part.