file_create_url() does not handle private files correctly in update.php

Created on 1 May 2017, over 7 years ago
Updated 19 September 2023, about 1 year ago

When the function file_create_url() is called during a DB update, and passed a file URI containing the "private" stream wrapper, then it returns an incorrect URL. It appears to return a correct URL if it is passed a URI with a "public" (and also I assume, a "data") stream wrapper.

For instance, passing the URI

private://catalogues/2016-12/_1/catalogue_7-0.jpeg

resulted in a returned value of

http://devpepper/update.php/system/files/catalogues/2016-12/_1/catalogue...

, where the $GLOBALS[base_url] is "http://devpepper". Note the presence of the "update.php" in the string.

I note that this may get fixed when #2669074 Convert file_create_url() to service, deprecate it is completed.

The easiest work-around at this stage is to add the line $fixed_url = str_replace('/update.php/', '/', $returned_url); in the DB update function.

🐛 Bug report
Status

Closed: cannot reproduce

Version

9.5

Component
File system 

Last updated about 12 hours ago

Created by

🇳🇿New Zealand jlscott

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Status changed to Closed: cannot reproduce about 1 year ago
  • 🇳🇿New Zealand quietone

    More information was asked for 2 years ago an again 8 months but it hasn't been supplied. Since we need that to continue here, I am closing.

    If you are experiencing this problem on a supported version of Drupal reopen the issue, by setting the status to 'Active', and provide complete steps to reproduce the issue (starting from "Install Drupal core").

    Thanks!

Production build 0.71.5 2024