Manage security an usabitlity

Created on 4 April 2023, over 1 year ago

Problem/Motivation

Currenlty, the module allows to remove files whenthe user has the required permission, and file usage is checked only when the user confirms the status change from permanent to temporary.

So, in the files view, when we add the link to remove a file, it's displaying on all the files.

I can propose to add some security to avoid displaying when the file has no usage left,
and add some usefull condition to display the link when the file has still the status permanent. When temporary status, the link wouldn't appear.

Proposed resolution

<?php

namespace Drupal\corum_file_delete;

use Drupal\Core\Access\AccessResult;
use Drupal\Core\Entity\EntityInterface;
use Drupal\Core\Session\AccountInterface;
use Drupal\file\FileAccessControlHandler as BaseFileAccessControlHandler;

/**
 * Extends File access control to allow easily deleting files.
 */
class FileAccessControlHandler extends BaseFileAccessControlHandler {

  /**
   * {@inheritdoc}
   */
  protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
    // For any other operation, pass to default File access handler.
    if ($operation !== 'delete') {
      return parent::checkAccess($entity, $operation, $account);
    }

    // Check if User has our delete files permission.
    $result = AccessResult::allowedIfHasPermission($account, 'corum_delete_files');
    if ($result->isAllowed()) {
      $references = \Drupal::service('file.usage')->listUsage($entity);
      return AccessResult::allowedIf(empty($references) && $entity->isPermanent());
    }

    // Otherwise, pass to default File handler.
    return parent::checkAccess($entity, $operation, $account);
  }

}

Feature request
Status

Active

Version

2.0

Component

User interface

Created by

🇫🇷France frondeau Nantes, FRANCE

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024