Administrator cannot access to temporary files without usage that are owned by other users

Created on 22 September 2023, about 1 year ago

Problem/Motivation

Administrator cannot access to temporary files without usage that are owned by other users

Steps to reproduce

1. Create a image field in content type.
2. Create a node and upload a image but not save the node.
3. Access to /admin/content/files and the image file is temporary and file usage is 0
4. Click the file link, got Access Deny.

Proposed resolution

Add role check logic in file_file_download function.
If user is the Administrator, allowed to access the file.Instead of just only checking whether the file owner is the same as the current user.

πŸ› Bug report
Status

Needs work

Version

10.1 ✨

Component
File systemΒ  β†’

Last updated about 11 hours ago

Created by

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024