Allow download of permanent file by owner

Created on 5 October 2023, 9 months ago

Hi there.

We're using Protected File in combination with DropzoneJS. Immediately after uploading a file, we're seeing access to the thumbnail being denied, but saving the form and then coming back into the edit dialog does show it. I've identified that the cause is that DropZone makes the uploaded file permanent immediately, but doesn't yet create a reference to it. This causes the initial access check at line 342 to take the quick return path, whereas post-submit, it continues through to the rest of the function.

Changing

if (empty($references) && ($file->isPermanent() || $file->getOwnerId() != \Drupal::currentUser()->id())) {

to

if (empty($references) && $file->getOwnerId() != \Drupal::currentUser()->id()) {

(so that in the case where the references are empty and the file is permanent and the file owner is the user being considered, we don't return immediately); all other outcomes are the same.

✨ Feature request
Status

Active

Version

1.0

Component

Code

Created by

πŸ‡¦πŸ‡ΊAustralia Nigel Cunningham Geelong

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024