diff --git a/core/modules/file/src/Tests/FilePrivateTest.php b/core/modules/file/src/Tests/FilePrivateTest.php index 2705ef2..0580839 100644 --- a/core/modules/file/src/Tests/FilePrivateTest.php +++ b/core/modules/file/src/Tests/FilePrivateTest.php @@ -110,6 +110,34 @@ function testPrivateFile() { $this->drupalLogin($account); $this->drupalGet($file_url); $this->assertResponse(403, 'Confirmed that access is denied for another user to the temporary file.'); + + // Test that a file only referenced in an old revision is still accessible. + $this->drupalLogout(); + $this->drupalLogin($this->adminUser); + $old_file = $this->getTestFile('text'); + $new_file = $this->getTestFile('text'); + $nid = $this->uploadNodeFile($old_file, $field_name, $type_name, TRUE, array('private' => TRUE)); + \Drupal::entityManager()->getStorage('node')->resetCache(array($nid)); + $node = $node_storage->load($nid); + $node_old_revision_file = File::load($node->{$field_name}->target_id); + // Create a new revision with a new file. + $this->replaceNodeFile($new_file, $field_name, $nid); + // Ensure the old file can still be downloaded. + $this->drupalGet(file_create_url($node_old_revision_file->url())); + $this->assertResponse(200, t('Confirmed that a file referenced in an old node revision is accessible.')); + + // Test that a file only referenced in an old revision is restricted through + // field access. + $test_file = $this->getTestFile('text'); + $nid = $this->uploadNodeFile($test_file, $no_access_field_name, $type_name, TRUE, array('private' => TRUE)); + \Drupal::entityManager()->getStorage('node')->resetCache(array($nid)); + $node = $node_storage->load($nid); + $node_old_revision_file = File::load($node->{$no_access_field_name}->target_id); + // Create a new revision with a new file. + $this->replaceNodeFile($test_file, $no_access_field_name, $nid, TRUE); + // Ensure access is denied. + $this->drupalGet(file_create_url($node_old_revision_file->url())); + $this->assertResponse(403, t('Confirmed that access is denied for the file in an old revision without view field access permission.')); } }