Inform users that media items don't inherit access control from parents

Created on 6 July 2018, almost 6 years ago
Updated 19 April 2023, about 1 year ago

Problem/Motivation

Drupal's private file access handling will grant access to the file to whoever has access to the entity where the field is attached. This means that a node with a file field will keep access to the node and the file in sync (granting access to the file if the user has access to the node, etc).

This is still true when using files attached to media entities, in the sense that Drupal will by default grant access to the file to users that can access the media entity. However, users may have the expectation that access is also inherited from the entity referencing the media items, which doesn't happen.

This could lead to a potentially misconfigured site, where users could think their assets are protected but they end up being exposed publicly. This mismatch in expectation has been brought up in several issues recently, such as:
πŸ› Make private file access handling respect the full entity reference chain Postponed
#2937642: Access to files attached via media entities should be ultimately controlled by the published state of related content β†’
#2981131: Media Entity Pages Anonymous Permission β†’
#2980424: "View media" grants permission on all private media files (no host entity check?) β†’

While the real fix is being discussed in πŸ› Make private file access handling respect the full entity reference chain Postponed , this issue aims at reducing the confusion and making it explicit that Drupal does not do that out-of-the box, when using media entities instead of direct file fields.

Steps to reproduce:

Reference scenario (nodes with fields):

1) In a clean install, add a file field to a content type
2) When asked to configure the field storage, select "Private"
3) Create a node as unpublished, uploading a file to that field
4) As an anonymous user, try to reach directly the file URL

Result: Anonymous users do not have direct access to the file, if the node is unpublished.

"Problematic scenario" (nodes with media):

1) In a clean install with the Media module enabled, configure the "File" field on the "File" media type to use the "Private" file storage scheme
2) Add a media field (entity_reference) to a content type, allowing users to reference the "File" media type
3) Create a node as unpublished, uploading a file to that field
4) As an anonymous user, try to reach directly the file URL

Result: Anonymous users have direct access to the file, even though the node is unpublished.

Proposed resolution

Action 1:
Show some messages to the site builder to make that situation clear:

- When configuring a media source field to use the private filesystem

- When checking messages at the status report page

- In hook help text

Action 2:
Add some more detailed information about media access handling and possible misconfiguration scenarios in drupal.org documentation
- Created https://www.drupal.org/docs/8/core/modules/media/setting-up-private-acce... β†’ for that

Remaining tasks

- Review patch / Address feedback
- Complete documentation on https://www.drupal.org/docs/8/core/modules/media/setting-up-private-acce... β†’
- Collect sign-off
- Commit

User interface changes

- New message(s) will appear to site builders in some contexts (see screenshots above)

API changes

None.

Data model changes

None.

πŸ“Œ Task
Status

Needs work

Version

10.1 ✨

Component
MediaΒ  β†’

Last updated less than a minute ago

Created by

πŸ‡ͺπŸ‡ΈSpain marcoscano Barcelona, Spain

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the β€œReport a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024