diff --git a/core/modules/file/src/FileAccessControlHandler.php b/core/modules/file/src/FileAccessControlHandler.php index 0c13cb5..df73efb 100644 --- a/core/modules/file/src/FileAccessControlHandler.php +++ b/core/modules/file/src/FileAccessControlHandler.php @@ -27,7 +27,7 @@ protected function checkAccess(EntityInterface $entity, $operation, $langcode, A if (($operation == 'view') && (file_uri_scheme($entity->getFileUri()) == 'public')) { return AccessResult::allowed(); } - if ($operation == 'download' || $operation == 'view') { + elseif ($operation == 'download' || $operation == 'view') { $references = $this->getFileReferences($entity); if ($references) { foreach ($references as $field_name => $entity_map) { diff --git a/core/modules/file/src/Tests/AccessTest.php b/core/modules/file/src/Tests/AccessTest.php index 5c4f4fa..a2dd4e1 100644 --- a/core/modules/file/src/Tests/AccessTest.php +++ b/core/modules/file/src/Tests/AccessTest.php @@ -31,17 +31,16 @@ function testFileAccess() { // Save it, inserting a new record. $file->save(); + // Create authenticated user to check file access. $account = $this->createUser(array('access site reports')); - $access = $file->access('view', $account); - $this->assertTrue($access, 'Public file is accessible to different user'); + $this->assertTrue($file->access('view', $account), 'Public file is accessible to different authenticated user'); // Create anonymous user to check file access. $account = $this->createUser()->getAnonymousUser(); - $access = $file->access('view', $account); - $this->assertTrue($access, 'Public file is accessible to anonymous user'); + $this->assertTrue($file->access('view', $account), 'Public file is accessible to anonymous user'); // Create a new file entity. $file = File::create(array( @@ -56,16 +55,14 @@ function testFileAccess() { // Save it, inserting a new record. $file->save(); + // Create authenticated user to check file access. $account = $this->createUser(array('access site reports')); - $access = $file->access('view', $account); - - $this->assertFalse($access, 'Public file is not accessible to different user'); + $this->assertFalse($file->access('view', $account), 'Private file is not accessible to different authenticated user'); // Create anonymous user to check file access. $account = $this->createUser()->getAnonymousUser(); - $access = $file->access('view', $account); - $this->assertFalse($access, 'Public file is not accessible to anonymous user'); + $this->assertFalse($file->access('view', $account), 'Private file is not accessible to anonymous user'); } -} \ No newline at end of file +}