File rest permission issue

Created on 19 August 2021, almost 4 years ago
Updated 7 July 2025, about 21 hours ago

Problem/Motivation

Uploading files via rest is not allowed when a user / role DOES have permission for the bundle. The error thrown is below;

Path: /file/upload/node/{bundle}/{field}?_format=hal_json. Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: in Drupal\file\Plugin\rest\resource\FileUploadResource->validateAndLoadFieldDefinition() (line 443 of /var/www/d9/core/modules/file/src/Plugin/rest/resource/FileUploadResource.php).

A bare-bone Drupal installation does not have "field permissions" unless installing "Field Permissions" module. The way I see it, it is impossible to upload a file for other roles apart from an administrator.

If a role has create/edit permission on the bundle, the field should inherit the bundle permissions.

```

$entity_access_control_handler = $this->entityTypeManager->getAccessControlHandler($entity_type_id);
    $bundle = $this->entityTypeManager->getDefinition($entity_type_id)->hasKey('bundle') ? $bundle : NULL;
    $access_result = $entity_access_control_handler->createAccess($bundle, NULL, [], TRUE)
      ->andIf($entity_access_control_handler->fieldAccess('edit', $field_definition, NULL, NULL, TRUE));
    if (!$access_result->isAllowed()) {
      throw new AccessDeniedHttpException($access_result->getReason());
}

```

Steps to reproduce

Make a post request to "/file/upload/node/{bundle}/{field}?_format=hal_json" as any role apart from administrator.

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

πŸ› Bug report
Status

Active

Version

11.0 πŸ”₯

Component

file system

Created by

πŸ‡¬πŸ‡§United Kingdom sadikyalcin

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024