diff --git a/core/modules/field/tests/src/Kernel/EntityReference/EntityReferenceItemTest.php b/core/modules/field/tests/src/Kernel/EntityReference/EntityReferenceItemTest.php index 6dce67b45f..2d98de66d3 100644 --- a/core/modules/field/tests/src/Kernel/EntityReference/EntityReferenceItemTest.php +++ b/core/modules/field/tests/src/Kernel/EntityReference/EntityReferenceItemTest.php @@ -524,6 +524,7 @@ public function testAutocreateValidation() { $file = File::create([ 'filename' => $filename, 'status' => 0, + 'uid' => 1, ]); $entity = EntityTest::create([ diff --git a/core/modules/file/file.routing.yml b/core/modules/file/file.routing.yml index e182c97ee1..11d754bbc4 100644 --- a/core/modules/file/file.routing.yml +++ b/core/modules/file/file.routing.yml @@ -4,3 +4,14 @@ file.ajax_progress: _controller: '\Drupal\file\Controller\FileWidgetAjaxController::progress' requirements: _permission: 'access content' +file.upload: + path: '/file/upload/{file}' + methods: [POST] + defaults: + _controller: '\Drupal\file\Controller\FileUploadController::upload' + requirements: + _entity_access: 'file.update' + options: + parameters: + file: + type: entity:file diff --git a/core/modules/file/src/Controller/FileUploadController.php b/core/modules/file/src/Controller/FileUploadController.php new file mode 100644 index 0000000000..8703b86c11 --- /dev/null +++ b/core/modules/file/src/Controller/FileUploadController.php @@ -0,0 +1,96 @@ +get('file_system') + ); + } + + /** + * Constructs a FileUploadController instance. + * + * @param \Drupal\Core\File\FileSystem $file_system + */ + public function __construct(FileSystem $file_system) { + $this->fileSystem = $file_system; + } + + /** + * Handles binary file uploads. + * + * @param \Symfony\Component\HttpFoundation\Request $request + * @param \Drupal\file\Entity\File $file + */ + public function upload(Request $request, File $file) { + if ($request->headers->get('Content-Type') !== 'application/octet-stream') { + throw new HttpException(400, '"application/octet-stream" content type must be used to send binary file data'); + } + + // Check the destination file path is writable. + if (!is_writable($this->fileSystem->realpath($file->getFileUri()))) { + throw new HttpException(500, 'Destination file path is not writable'); + } + + $this->streamUploadData($file); + + return new Response('OK'); + } + + /** + * Streams file upload data to temporary file and moves to file destination. + * + * @param \Drupal\file\Entity\File $file + * + * @throws \Symfony\Component\HttpKernel\Exception\HttpException + */ + protected function streamUploadData(File $file) { + // 'rb' is needed so reading works correctly on windows environments too. + $file_data = fopen('php://input','rb'); + + $temp_file_name = $this->fileSystem->tempnam('temporary://', 'file'); + + if ($temp_file = fopen($temp_file_name, 'wb')) { + while(!feof($file_data)) { + fwrite($temp_file, fread($file_data, 8192)); + } + + fclose($temp_file); + + // Move the file to the correct location based on the file entity, + // replacing any existing file. + if (!file_unmanaged_move($temp_file_name, $file->getFileUri(), FILE_EXISTS_REPLACE)) { + throw new HttpException(500, 'Temporary file could not be moved to file location'); + } + } + else { + $this->getLogger('file system')->error('Temporary file "%path" could not be opened for file upload', ['%path' => $temp_file_name]); + throw new HttpException(500, 'Temporary file could not be opened'); + } + + fclose($file_data); + } + +} diff --git a/core/modules/file/src/Entity/File.php b/core/modules/file/src/Entity/File.php index a68b9bae9b..b8c130728c 100644 --- a/core/modules/file/src/Entity/File.php +++ b/core/modules/file/src/Entity/File.php @@ -234,6 +234,7 @@ public static function baseFieldDefinitions(EntityTypeInterface $entity_type) { $fields['uid'] = BaseFieldDefinition::create('entity_reference') ->setLabel(t('User ID')) ->setDescription(t('The user ID of the file.')) + ->setDefaultValueCallback('\Drupal\file\Entity\File::getCurrentUserId') ->setSetting('target_type', 'user'); $fields['filename'] = BaseFieldDefinition::create('string') @@ -274,4 +275,16 @@ public static function baseFieldDefinitions(EntityTypeInterface $entity_type) { return $fields; } + /** + * Default value callback for 'uid' base field definition. + * + * @see \Drupal\file\Entity\File::baseFieldDefinitions::baseFieldDefinitions(). + * + * @return array + * An array of default values. + */ + public static function getCurrentUserId() { + return array(\Drupal::currentUser()->id()); + } + } diff --git a/core/modules/file/src/FileAccessControlHandler.php b/core/modules/file/src/FileAccessControlHandler.php index a82c460539..9475458c2b 100644 --- a/core/modules/file/src/FileAccessControlHandler.php +++ b/core/modules/file/src/FileAccessControlHandler.php @@ -47,10 +47,11 @@ protected function checkAccess(EntityInterface $entity, $operation, AccountInter if ($operation == 'delete' || $operation == 'update') { $account = $this->prepareUser($account); - $file_uid = $entity->get('uid')->getValue(); - // Only the file owner can delete and update the file entity. - if ($account->id() == $file_uid[0]['target_id']) { - return AccessResult::allowed(); + $file_uid = $entity->get('uid')->target_id; + // Only admins or the file owner can delete and update the file entity. + // @todo Create a new permission to handle this? + if ($account->hasPermission('administer nodes') || ($account->id() == $file_uid)) { + return AccessResult::allowed()->cachePerPermissions(); } return AccessResult::forbidden(); } @@ -96,8 +97,6 @@ protected function checkCreateAccess(AccountInterface $account, array $context, // create file entities that are referenced from another entity // (e.g. an image for a article). A contributed module is free to alter // this to allow file entities to be created directly. - // @todo Update comment to mention REST module when - // https://www.drupal.org/node/1927648 is fixed. return AccessResult::neutral(); } diff --git a/core/modules/hal/hal.services.yml b/core/modules/hal/hal.services.yml index 97fcbfb13d..63a3d7ab4d 100644 --- a/core/modules/hal/hal.services.yml +++ b/core/modules/hal/hal.services.yml @@ -12,11 +12,6 @@ services: class: Drupal\hal\Normalizer\FieldNormalizer tags: - { name: normalizer, priority: 10 } - serializer.normalizer.file_entity.hal: - class: Drupal\hal\Normalizer\FileEntityNormalizer - tags: - - { name: normalizer, priority: 20 } - arguments: ['@entity.manager', '@http_client', '@hal.link_manager', '@module_handler'] serializer.normalizer.entity.hal: class: Drupal\hal\Normalizer\ContentEntityNormalizer arguments: ['@hal.link_manager', '@entity.manager', '@module_handler'] diff --git a/core/modules/hal/src/Normalizer/FileEntityNormalizer.php b/core/modules/hal/src/Normalizer/FileEntityNormalizer.php deleted file mode 100644 index ec870e9e14..0000000000 --- a/core/modules/hal/src/Normalizer/FileEntityNormalizer.php +++ /dev/null @@ -1,70 +0,0 @@ -httpClient = $http_client; - } - - /** - * {@inheritdoc} - */ - public function normalize($entity, $format = NULL, array $context = []) { - $data = parent::normalize($entity, $format, $context); - // Replace the file url with a full url for the file. - $data['uri'][0]['value'] = $this->getEntityUri($entity); - - return $data; - } - - /** - * {@inheritdoc} - */ - public function denormalize($data, $class, $format = NULL, array $context = []) { - $file_data = (string) $this->httpClient->get($data['uri'][0]['value'])->getBody(); - - $path = 'temporary://' . drupal_basename($data['uri'][0]['value']); - $data['uri'] = file_unmanaged_save_data($file_data, $path); - - return $this->entityManager->getStorage('file')->create($data); - } - -} diff --git a/core/modules/hal/tests/src/Functional/FileDenormalizeTest.php b/core/modules/hal/tests/src/Functional/FileDenormalizeTest.php index 05ee234893..8202a367da 100644 --- a/core/modules/hal/tests/src/Functional/FileDenormalizeTest.php +++ b/core/modules/hal/tests/src/Functional/FileDenormalizeTest.php @@ -41,35 +41,10 @@ public function testFileDenormalize() { $this->assertTrue($denormalized instanceof File, 'A File instance was created.'); - $this->assertIdentical('temporary://' . $file->getFilename(), $denormalized->getFileUri(), 'The expected file URI was found.'); - $this->assertTrue(file_exists($denormalized->getFileUri()), 'The temporary file was found.'); - $this->assertIdentical($file->uuid(), $denormalized->uuid(), 'The expected UUID was found'); $this->assertIdentical($file->getMimeType(), $denormalized->getMimeType(), 'The expected MIME type was found.'); $this->assertIdentical($file->getFilename(), $denormalized->getFilename(), 'The expected filename was found.'); $this->assertTrue($denormalized->isPermanent(), 'The file has a permanent status.'); - - // Try to denormalize with the file uri only. - $file_name = 'test_2.txt'; - $file_path = 'public://' . $file_name; - - file_put_contents($file_path, 'hello world'); - $file_uri = file_create_url($file_path); - - $data = [ - 'uri' => [ - ['value' => $file_uri], - ], - ]; - - $denormalized = $serializer->denormalize($data, 'Drupal\file\Entity\File', 'hal_json'); - - $this->assertIdentical('temporary://' . $file_name, $denormalized->getFileUri(), 'The expected file URI was found.'); - $this->assertTrue(file_exists($denormalized->getFileUri()), 'The temporary file was found.'); - - $this->assertIdentical('text/plain', $denormalized->getMimeType(), 'The expected MIME type was found.'); - $this->assertIdentical($file_name, $denormalized->getFilename(), 'The expected filename was found.'); - $this->assertFalse($denormalized->isPermanent(), 'The file has a permanent status.'); } }