Drimage + StageFile Proxy + Webforms (Private)

Created on 30 April 2024, about 2 months ago

Problem/Motivation

When Drimage is used with Stage File Proxy (which is enabled, but has no configurations aka is not in use), and user (even UID 1) tries to download a private file (submitted by Webform, not sure if it extends to other files) - it results in page not found.

Steps to reproduce

Have stage file proxy enabled, drimage enabled, a webform with private files upload. Submit the webform, and then, using UID 1 try to view uploaded private files.

Proposed resolution

It seems that this piece of code, alters the original $event object.

  public function checkFileOrigin(RequestEvent $event): void {

    // Process to request uri, mainly to filter out language prefixes.
    $request_uri = $this->pathProcessorManager->processInbound(
      $event->getRequest()->getRequestUri(),
      $event->getRequest()
    );

I propose to send a clone of the request, not the request itself (as we just want to compare the URI paths anyway).

πŸ› Bug report
Status

Needs review

Version

2.2

Component

Code

Created by

πŸ‡ͺπŸ‡ΈSpain Nikro Benalmadena, Malaga

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.69.0 2024