Contrib.social

Profile owner cannot save profile after another user uploads private file to the profile.

Open on Drupal.org →
Created on 13 October 2017, about 7 years ago
Updated 2 May 2024, 7 months ago

Problem/Motivation

There is a strange case that happens when dealing with private file fields on a profile. If an administrator uploads a file to the private file field, the profile owner can no longer save the profile.

Steps to reproduce:

  1. Create a new Profile type called "Test Profile"
  2. Add a file field to the profile named "Private File Test" using the private:// file system.
  3. Create a new user that will be the profile owner named "Test User".
  4. Give the Test User the following permissions:
    • Test Profile: Create profile entities
    • Test Profile: Update own profile entities
    • Test Profile: View own profile
  5. Create a "Test Profile" for the new user.
  6. As another user (site administrator), upload a file to the "Private File Test" field and save the profile.
  7. As Test User, attempt to edit and save the Test Profile.

The Test User will receive the error: You do not have access to the referenced entity (file: [fid]). and will be unable to save the profile.

If you do these same steps on a Node, the Test User does not see the above error, and can save the node.

Research

So far I've tracked the issue to Drupal\file\FileAccessControlHandler::checkAccess() where "view" access is checked for the referencing entity (the profile).

This check is failing: $referencing_entity->access('view', $account, TRUE), but I'm not sure how to proceed debugging further. Any help is appreciated.

I've tried changing the owner of the file to be the owner of the profile, but the Test User still receives the error message and is unable to save the profile.

🐛 Bug report
Status

Active

Version

1.0

Component

Code

Created by

🇺🇸United States daggerhart

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Comment 7 months ago →
    🇨🇦Canada kylebehse

    I'm having the same issue. I have an Account Manager role, and they need to be able to save the profile of a user that has uploaded a private file. But it is throwing access errors.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024