User with limited permissions cannot replace a media image

Created on 14 March 2023, almost 2 years ago

Problem/Motivation

I am trying to solve a problem where a user with limited user permissions cannot replace a media image.

We can do the operation with the Administrator role but when we try to replace the image with a limited user role, we end up in the Path guard route validation and it returns an error and the image is impossible to be replaced.

Here is the stacktrace:

Symfony\Component\HttpFoundation\File\Exception\FileNotFoundException</em>: The file &quot;/tmp/phpW2AbCR&quot; does not exist in <em class="placeholder">Symfony\Component\HttpFoundation\File\File-&gt;__construct()</em> (line <em class="placeholder">36</em> of <em class="placeholder">/var/www/html/vendor/symfony/http-foundation/File/File.php</em>). <pre class="backtrace">Symfony\Component\HttpFoundation\File\UploadedFile-&gt;__construct(&#039;/tmp/phpW2AbCR&#039;, &#039;dhl.png&#039;, &#039;image/png&#039;, 0, ) (Line: 86)
Symfony\Component\HttpFoundation\FileBag-&gt;convertFileInformation(Array) (Line: 89)
Symfony\Component\HttpFoundation\FileBag-&gt;Symfony\Component\HttpFoundation\{closure}(Array)
array_map(Object, Array) (Line: 89)
Symfony\Component\HttpFoundation\FileBag-&gt;convertFileInformation(Array) (Line: 52)
Symfony\Component\HttpFoundation\FileBag-&gt;set(&#039;files&#039;, Array) (Line: 61)
Symfony\Component\HttpFoundation\FileBag-&gt;add(Array) (Line: 40)
Symfony\Component\HttpFoundation\FileBag-&gt;replace(Array) (Line: 31)
Symfony\Component\HttpFoundation\FileBag-&gt;__construct(Array) (Line: 269)
Symfony\Component\HttpFoundation\Request-&gt;initialize(Array, Array, Array, Array, Array, Array, NULL) (Line: 247)
Symfony\Component\HttpFoundation\Request-&gt;__construct(Array, Array, Array, Array, Array, Array, NULL) (Line: 65)
Drupal\Core\Http\TrustedHostsRequestFactory-&gt;createRequest(Array, Array, Array, Array, Array, Array, NULL) (Line: 1969)
Symfony\Component\HttpFoundation\Request::createRequestFromFactory(Array, Array, Array, Array, Array, Array) (Line: 293)
Symfony\Component\HttpFoundation\Request::createFromGlobals() (Line: 151)
Drupal\Core\Routing\AccessAwareRouter-&gt;match(&#039;/media/3091&#039;) (Line: 161)
Drupal\Core\Path\PathValidator-&gt;getPathAttributes(&#039;/media/3091&#039;, Object, 1) (Line: 122)
Drupal\Core\Path\PathValidator-&gt;getUrl(&#039;image/second-test&#039;, 1) (Line: 82)
Drupal\Core\Path\PathValidator-&gt;getUrlIfValid(&#039;/image/second-test&#039;) (Line: 62)
Drupal\path_guard\Plugin\Validation\Constraint\ExistingPathValidator-&gt;validate(Object, Object) (Line: 201)
Drupal\Core\TypedData\Validation\RecursiveContextualValidator-&gt;validateConstraints(Object, &#039;0000000016466abf0000000068f2a272&#039;, Array) (Line: 153)
Drupal\Core\TypedData\Validation\RecursiveContextualValidator-&gt;validateNode(Object) (Line: 163)
Drupal\Core\TypedData\Validation\RecursiveContextualValidator-&gt;validateNode(Object) (Line: 163)
Drupal\Core\TypedData\Validation\RecursiveContextualValidator-&gt;validateNode(Object, Array, 1) (Line: 105)
Drupal\Core\TypedData\Validation\RecursiveContextualValidator-&gt;validate(Object, NULL, NULL) (Line: 93)
Drupal\Core\TypedData\Validation\RecursiveValidator-&gt;validate(Object) (Line: 132)
Drupal\Core\TypedData\TypedData-&gt;validate() (Line: 489)
Drupal\Core\Entity\ContentEntityBase-&gt;validate() (Line: 419)
Drupal\media\Entity\Media-&gt;validate() (Line: 188)
Drupal\Core\Entity\ContentEntityForm-&gt;validateForm(Array, Object)
call_user_func_array(Array, Array) (Line: 82)
Drupal\Core\Form\FormValidator-&gt;executeValidateHandlers(Array, Object) (Line: 275)
Drupal\Core\Form\FormValidator-&gt;doValidateForm(Array, Object, &#039;media_image_edit_form&#039;) (Line: 118)
Drupal\Core\Form\FormValidator-&gt;validateForm(&#039;media_image_edit_form&#039;, Array, Object) (Line: 591)
Drupal\Core\Form\FormBuilder-&gt;processForm(&#039;media_image_edit_form&#039;, Array, Object) (Line: 323)
Drupal\Core\Form\FormBuilder-&gt;buildForm(Object, Object) (Line: 73)
Drupal\Core\Controller\FormController-&gt;getContentResult(Object, Object)
call_user_func_array(Array, Array) (Line: 123)
Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber-&gt;Drupal\Core\EventSubscriber\{closure}() (Line: 580)
Drupal\Core\Render\Renderer-&gt;executeInRenderContext(Object, Object) (Line: 124)
Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber-&gt;wrapControllerExecutionInRenderContext(Array, Array) (Line: 97)
Drupal\Core\EventSubscriber\EarlyRenderingControllerWrapperSubscriber-&gt;Drupal\Core\EventSubscriber\{closure}() (Line: 169)
Symfony\Component\HttpKernel\HttpKernel-&gt;handleRaw(Object, 1) (Line: 81)
Symfony\Component\HttpKernel\HttpKernel-&gt;handle(Object, 1, 1) (Line: 58)
Drupal\Core\StackMiddleware\Session-&gt;handle(Object, 1, 1) (Line: 48)
Drupal\Core\StackMiddleware\KernelPreHandle-&gt;handle(Object, 1, 1) (Line: 106)
Drupal\page_cache\StackMiddleware\PageCache-&gt;pass(Object, 1, 1) (Line: 85)
Drupal\page_cache\StackMiddleware\PageCache-&gt;handle(Object, 1, 1) (Line: 48)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware-&gt;handle(Object, 1, 1) (Line: 51)
Drupal\Core\StackMiddleware\NegotiationMiddleware-&gt;handle(Object, 1, 1) (Line: 23)
Stack\StackedHttpKernel-&gt;handle(Object, 1, 1) (Line: 713)
Drupal\Core\DrupalKernel-&gt;handle(Object) (Line: 19)

The error related to Path guard is:
Drupal\path_guard\Plugin\Validation\Constraint\ExistingPathValidator->validate(Object, Object) (Line: 201)

The problem is fixed if I disable Path guard.

I debugged the problem a bit and it seems like the path it's trying to validate is /image/image-name.

Steps to reproduce

1. Enable Path guard module.
2. Create a limited user role which cannot do all the operations in the site.
3. Upload a media image.
4. Edit the media image and try to replace the image.

🐛 Bug report
Status

Active

Component

Code

Created by

🇫🇮Finland heikkiy Oulu

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024