diff --git a/core/modules/field/tests/src/Kernel/EntityReference/EntityReferenceItemTest.php b/core/modules/field/tests/src/Kernel/EntityReference/EntityReferenceItemTest.php index 6dce67b45f..2d98de66d3 100644 --- a/core/modules/field/tests/src/Kernel/EntityReference/EntityReferenceItemTest.php +++ b/core/modules/field/tests/src/Kernel/EntityReference/EntityReferenceItemTest.php @@ -524,6 +524,7 @@ public function testAutocreateValidation() { $file = File::create([ 'filename' => $filename, 'status' => 0, + 'uid' => 1, ]); $entity = EntityTest::create([ diff --git a/core/modules/file/file.routing.yml b/core/modules/file/file.routing.yml index e182c97ee1..a349aa7b3e 100644 --- a/core/modules/file/file.routing.yml +++ b/core/modules/file/file.routing.yml @@ -4,3 +4,16 @@ file.ajax_progress: _controller: '\Drupal\file\Controller\FileWidgetAjaxController::progress' requirements: _permission: 'access content' +file.upload: + path: '/file/upload/{file}' + methods: [POST] + defaults: + _controller: '\Drupal\file\Controller\FileUploadController::upload' + requirements: + _access: 'TRUE' + # @todo Re-enable this. + #_entity_access: 'file.update' + options: + parameters: + file: + type: entity:file diff --git a/core/modules/file/src/Controller/FileUploadController.php b/core/modules/file/src/Controller/FileUploadController.php new file mode 100644 index 0000000000..0bbc8e00e5 --- /dev/null +++ b/core/modules/file/src/Controller/FileUploadController.php @@ -0,0 +1,99 @@ +fileSystem = $file_system; + } + + /** + * {@inheritdoc} + */ + public static function create(ContainerInterface $container) { + return new static( + $container->get('file_system') + ); + } + + /** + * Handles binary file uploads. + * + * @param \Symfony\Component\HttpFoundation\Request $request + * @param \Drupal\file\FileInterface $file + */ + public function upload(Request $request, FileInterface $file) { + if ($request->headers->get('Content-Type') !== 'application/octet-stream') { + throw new HttpException(415, 'The "application/octet-stream" content type must be used to send binary file data'); + } + + // Check the destination file path is writable. + if (!is_writable($this->fileSystem->realpath($file->getFileUri()))) { + throw new HttpException(500, 'Destination file path is not writable'); + } + + $this->streamUploadData($file); + + // Save the file so file size is re-calculated. + $file->save(); + + return new Response('OK'); + } + + /** + * Streams file upload data to temporary file and moves to file destination. + * + * @param \Drupal\file\FileInterface $file + * + * @throws \Symfony\Component\HttpKernel\Exception\HttpException + */ + protected function streamUploadData(FileInterface $file) { + // 'rb' is needed so reading works correctly on windows environments too. + $file_data = fopen('php://input','rb'); + + $temp_file_name = $this->fileSystem->tempnam('temporary://', 'file'); + + if ($temp_file = fopen($temp_file_name, 'wb')) { + while (!feof($file_data)) { + fwrite($temp_file, fread($file_data, 8192)); + } + + fclose($temp_file); + + // Move the file to the correct location based on the file entity, + // replacing any existing file. + if (!file_unmanaged_move($temp_file_name, $file->getFileUri(), FILE_EXISTS_REPLACE)) { + throw new HttpException(500, 'Temporary file could not be moved to file location'); + } + } + else { + $this->getLogger('file system')->error('Temporary file "%path" could not be opened for file upload', ['%path' => $temp_file_name]); + throw new HttpException(500, 'Temporary file could not be opened'); + } + + fclose($file_data); + } + +} diff --git a/core/modules/file/src/Entity/File.php b/core/modules/file/src/Entity/File.php index a68b9bae9b..b8c130728c 100644 --- a/core/modules/file/src/Entity/File.php +++ b/core/modules/file/src/Entity/File.php @@ -234,6 +234,7 @@ public static function baseFieldDefinitions(EntityTypeInterface $entity_type) { $fields['uid'] = BaseFieldDefinition::create('entity_reference') ->setLabel(t('User ID')) ->setDescription(t('The user ID of the file.')) + ->setDefaultValueCallback('\Drupal\file\Entity\File::getCurrentUserId') ->setSetting('target_type', 'user'); $fields['filename'] = BaseFieldDefinition::create('string') @@ -274,4 +275,16 @@ public static function baseFieldDefinitions(EntityTypeInterface $entity_type) { return $fields; } + /** + * Default value callback for 'uid' base field definition. + * + * @see \Drupal\file\Entity\File::baseFieldDefinitions::baseFieldDefinitions(). + * + * @return array + * An array of default values. + */ + public static function getCurrentUserId() { + return array(\Drupal::currentUser()->id()); + } + } diff --git a/core/modules/file/src/FileAccessControlHandler.php b/core/modules/file/src/FileAccessControlHandler.php index a82c460539..9475458c2b 100644 --- a/core/modules/file/src/FileAccessControlHandler.php +++ b/core/modules/file/src/FileAccessControlHandler.php @@ -47,10 +47,11 @@ protected function checkAccess(EntityInterface $entity, $operation, AccountInter if ($operation == 'delete' || $operation == 'update') { $account = $this->prepareUser($account); - $file_uid = $entity->get('uid')->getValue(); - // Only the file owner can delete and update the file entity. - if ($account->id() == $file_uid[0]['target_id']) { - return AccessResult::allowed(); + $file_uid = $entity->get('uid')->target_id; + // Only admins or the file owner can delete and update the file entity. + // @todo Create a new permission to handle this? + if ($account->hasPermission('administer nodes') || ($account->id() == $file_uid)) { + return AccessResult::allowed()->cachePerPermissions(); } return AccessResult::forbidden(); } @@ -96,8 +97,6 @@ protected function checkCreateAccess(AccountInterface $account, array $context, // create file entities that are referenced from another entity // (e.g. an image for a article). A contributed module is free to alter // this to allow file entities to be created directly. - // @todo Update comment to mention REST module when - // https://www.drupal.org/node/1927648 is fixed. return AccessResult::neutral(); } diff --git a/core/modules/file/tests/src/Functional/FileUploadTest.php b/core/modules/file/tests/src/Functional/FileUploadTest.php new file mode 100644 index 0000000000..f0d576dd3b --- /dev/null +++ b/core/modules/file/tests/src/Functional/FileUploadTest.php @@ -0,0 +1,106 @@ +adminUser = $this->drupalCreateUser(['access content', 'access administration pages', 'administer site configuration', 'administer users', 'administer permissions', 'administer content types', 'administer node fields', 'administer node display', 'administer nodes', 'bypass node access']); + $this->user = $this->drupalCreateUser([], 'user1', TRUE); + $this->drupalLogin($this->user); + + $this->file = File::create([ + 'uid' => $this->user->id(), + 'uri' => 'public://example.txt', + ]); + + $this->file->save(); + + $this->refreshVariables(); + } + + /** + * Tests using the file upload route. + */ + public function testFileUpload() { + $new_file_data = 'TEST WITH NEW DATA'; + + // The wrong content type should return a 415 code. + $response = $this->fileRequest(Url::fromRoute('file.upload', ['file' => $this->file->id()]), $new_file_data, 'application/json'); + $this->assertSame(415, $response->getStatusCode()); + + $response = $this->fileRequest(Url::fromRoute('file.upload', ['file' => $this->file->id()]), $new_file_data); + + $this->assertSame(200, $response->getStatusCode()); + $this->assertSame('OK', (string) $response->getBody()); + $this->assertSame($new_file_data, file_get_contents('public://example.txt')); + } + + /** + * Performs a file upload request. Wraps the Guzzle HTTP client. + * + * @see \GuzzleHttp\ClientInterface::request() + * + * @param string $method + * HTTP method. + * @param \Drupal\Core\Url $url + * URL to request. + * @param array $request_options + * Request options to apply. + * + * @return \Psr\Http\Message\ResponseInterface + */ + protected function fileRequest(Url $url, $file_contents, $content_type = 'application/octet-stream') { + $request_options = []; + $request_options[RequestOptions::HTTP_ERRORS] = FALSE; + $request_options['headers']['Content-Type'] = $content_type; + $request_options['body'] = $file_contents; + + $session = $this->getSession(); + $this->prepareRequest(); + + $client = $session->getDriver()->getClient()->getClient(); + return $client->request('POST', $url->setAbsolute(TRUE)->toString(), $request_options); + } + +} diff --git a/core/modules/hal/hal.services.yml b/core/modules/hal/hal.services.yml index 97fcbfb13d..39d3dd8104 100644 --- a/core/modules/hal/hal.services.yml +++ b/core/modules/hal/hal.services.yml @@ -16,7 +16,7 @@ services: class: Drupal\hal\Normalizer\FileEntityNormalizer tags: - { name: normalizer, priority: 20 } - arguments: ['@entity.manager', '@http_client', '@hal.link_manager', '@module_handler'] + arguments: ['@entity.manager', '@hal.link_manager', '@module_handler'] serializer.normalizer.entity.hal: class: Drupal\hal\Normalizer\ContentEntityNormalizer arguments: ['@hal.link_manager', '@entity.manager', '@module_handler'] diff --git a/core/modules/hal/src/Normalizer/FileEntityNormalizer.php b/core/modules/hal/src/Normalizer/FileEntityNormalizer.php index ec870e9e14..5e45d59711 100644 --- a/core/modules/hal/src/Normalizer/FileEntityNormalizer.php +++ b/core/modules/hal/src/Normalizer/FileEntityNormalizer.php @@ -4,8 +4,8 @@ use Drupal\Core\Entity\EntityManagerInterface; use Drupal\Core\Extension\ModuleHandlerInterface; +use Drupal\file\FileInterface; use Drupal\hal\LinkManager\LinkManagerInterface; -use GuzzleHttp\ClientInterface; /** * Converts the Drupal entity object structure to a HAL array structure. @@ -17,31 +17,20 @@ class FileEntityNormalizer extends ContentEntityNormalizer { * * @var string */ - protected $supportedInterfaceOrClass = 'Drupal\file\FileInterface'; - - /** - * The HTTP client. - * - * @var \GuzzleHttp\ClientInterface - */ - protected $httpClient; + protected $supportedInterfaceOrClass = FileInterface::class; /** * Constructs a FileEntityNormalizer object. * * @param \Drupal\Core\Entity\EntityManagerInterface $entity_manager * The entity manager. - * @param \GuzzleHttp\ClientInterface $http_client - * The HTTP Client. * @param \Drupal\hal\LinkManager\LinkManagerInterface $link_manager * The hypermedia link manager. * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler * The module handler. */ - public function __construct(EntityManagerInterface $entity_manager, ClientInterface $http_client, LinkManagerInterface $link_manager, ModuleHandlerInterface $module_handler) { + public function __construct(EntityManagerInterface $entity_manager, LinkManagerInterface $link_manager, ModuleHandlerInterface $module_handler) { parent::__construct($link_manager, $entity_manager, $module_handler); - - $this->httpClient = $http_client; } /** @@ -55,16 +44,4 @@ public function normalize($entity, $format = NULL, array $context = []) { return $data; } - /** - * {@inheritdoc} - */ - public function denormalize($data, $class, $format = NULL, array $context = []) { - $file_data = (string) $this->httpClient->get($data['uri'][0]['value'])->getBody(); - - $path = 'temporary://' . drupal_basename($data['uri'][0]['value']); - $data['uri'] = file_unmanaged_save_data($file_data, $path); - - return $this->entityManager->getStorage('file')->create($data); - } - } diff --git a/core/modules/hal/tests/src/Functional/FileDenormalizeTest.php b/core/modules/hal/tests/src/Functional/FileDenormalizeTest.php index 05ee234893..8202a367da 100644 --- a/core/modules/hal/tests/src/Functional/FileDenormalizeTest.php +++ b/core/modules/hal/tests/src/Functional/FileDenormalizeTest.php @@ -41,35 +41,10 @@ public function testFileDenormalize() { $this->assertTrue($denormalized instanceof File, 'A File instance was created.'); - $this->assertIdentical('temporary://' . $file->getFilename(), $denormalized->getFileUri(), 'The expected file URI was found.'); - $this->assertTrue(file_exists($denormalized->getFileUri()), 'The temporary file was found.'); - $this->assertIdentical($file->uuid(), $denormalized->uuid(), 'The expected UUID was found'); $this->assertIdentical($file->getMimeType(), $denormalized->getMimeType(), 'The expected MIME type was found.'); $this->assertIdentical($file->getFilename(), $denormalized->getFilename(), 'The expected filename was found.'); $this->assertTrue($denormalized->isPermanent(), 'The file has a permanent status.'); - - // Try to denormalize with the file uri only. - $file_name = 'test_2.txt'; - $file_path = 'public://' . $file_name; - - file_put_contents($file_path, 'hello world'); - $file_uri = file_create_url($file_path); - - $data = [ - 'uri' => [ - ['value' => $file_uri], - ], - ]; - - $denormalized = $serializer->denormalize($data, 'Drupal\file\Entity\File', 'hal_json'); - - $this->assertIdentical('temporary://' . $file_name, $denormalized->getFileUri(), 'The expected file URI was found.'); - $this->assertTrue(file_exists($denormalized->getFileUri()), 'The temporary file was found.'); - - $this->assertIdentical('text/plain', $denormalized->getMimeType(), 'The expected MIME type was found.'); - $this->assertIdentical($file_name, $denormalized->getFilename(), 'The expected filename was found.'); - $this->assertFalse($denormalized->isPermanent(), 'The file has a permanent status.'); } }