There is no way to delete file entities of other users

Created on 1 March 2018, over 6 years ago
Updated 19 February 2023, almost 2 years ago

Problem/Motivation

Currently it's only possible to delete a file entity by the owner of an file entity. There is no additional condition defined for any permission or even an exception for user/1 (main admin user).

Proposed resolution

  • Add a delete form for files
  • Add a button to the list of file operations
  • Add two new permissions, delete any files and delete own files.

Remaining tasks

User interface changes

New form and button for deleting files - reusing existing patterns

API changes

New permissions

Data model changes

None expected.

Original Issue summary:

I've faced with problem when user with id '1' (main admin user) can't delete file entities created by another user. I used view_bulk_operations for deleting file entities. I thought user 1 has absolute access to all entities.

Release notes snippet

Content administrators can now be given permission to delete any file, rather than just files they created. An operations field can be added to views on File entities to add a delete button. The view that ships with the File module has been updated to include the operations field. Existing sites need to add themselves.

🐛 Bug report
Status

Fixed

Version

10.1

Component
File system 

Last updated about 11 hours ago

Created by

🇺🇦Ukraine khiminrm

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇩🇪Germany mrshowerman Munich

    In case anyone needs it, here's #149 re-rolled to 9.5.x. The only change is the updated imports mentioned by @MegaChriz.

  • Status changed to Needs work almost 2 years ago
  • The Needs Review Queue Bot tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".

    Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

    Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.

  • Status changed to RTBC almost 2 years ago
  • 🇫🇷France nod_ Lille

    Bot was tripped up by the last patch for a different branch than the issue's.

  • 🇳🇱Netherlands megachriz

    Let's hide the patch that's not relevant for the commit.

  • 🇫🇷France nod_ Lille

    Excluding this issue from bot review since
    1. The last patch is for a different branch and no tests were run on it (as such I'm not able to know it's for a different branch and to ignore it)
    2. There is an open MR more recent than the actual patch that needs to be committed.

    • lauriii committed 74fbfda7 on 10.1.x
      Issue #2949017 by alexpott, voleger, sourabhjain, oakulm, C-Logemann,...
  • Status changed to Fixed almost 2 years ago
  • 🇫🇮Finland lauriii Finland

    Few notes:

    1. Was surprised to see that File didn't have a list builder and why are we adding it here. This is explained in #143.
    2. The install profile changes seem fine. I like that the default config is built based on what makes sense rather than just applying the post update. Re-installed with Standard and Umami to make sure the defaults make sense and #145 has been addressed.
    3. Confirmed that sorting the table is sufficient for ensuring deterministic tests. Looks like there aren't any files with random names meaning this is fine.
    4. Dropbuttons with a single option in Claro look a bit strange but eventually this will be addressed by Add new Splitbutton render element to eventually replace Dropbutton Needs work .
    5. +++ b/core/modules/file/file.post_update.php
      @@ -13,3 +16,17 @@ function file_removed_post_updates() {
      +  /** @var \Drupal\views\ViewsConfigUpdater $view_config_updater */
      

      Removed this comment on commit.

    Committed 0d58b3c and pushed to 10.1.x. Thanks!

    Not backporting to 10.0.x or 9.5.x because of the post update hook.

Production build 0.71.5 2024