Problem/Motivation

For private files, file download system doesn't consider the published translation.

Steps to reproduce

This issue occurs when content is translatable. File upload field added on the content type is also translatable along with file upload file.
When the translation is published and if we try to access the file attached on translation, it fails.

- Create article content type.
- Add file upload field ensure that upload destination is set to private files
- Enable content translation, content moderation and add language.
- Enable article content type to use content moderation.
- Visit "admin/config/regional/content-language" and enable translation for all the article field including newly added private file field.
Ensure that file upload is also translated, not just alt text and name
- Create the English content for the node (don't upload file yet) and keep it in draft.
- Translate the above english content into other language, upload the private file and publish the translation.
- Check the file path on content translation i.e. /system/files/2025-06/abc.txt.
- Try to access the file using file path directly and see it doesn't work despite the translation is published.
- Publish the "English" translation
- Access the file using direct path like " /system/files/2025-06/abc.txt." and it works because English translation is published.

Proposed resolution

In file_get_file_references() we should ensure that we check the appropriate translation.

Remaining tasks

- MR
- Add tests

User interface changes

N/A

Introduced terminology

N/A

API changes

N/A

Data model changes

N/A

Release notes snippet

N/A

Original report by @simbaw

In my site, we enabled workflow and translation.
Reproduce steps:
1. Create a new content A and save to 'Draft'.
2. Translate content A and upload image to image filed, then save this translation to 'Published'.
3. View image by image link:
Actual: Anonymous User can not access this image.
Expect: Anonymous User can access this image.

Root cause: function file_get_file_references() returns is not correct.

CommentFileSizeAuthor
#30 3090998-30.diff3.92 KBherved
#28 3090998-28.diff3.63 KBherved
#9 Translation-is-not-supported-in-file-module-3090998-9.patch807 bytesrakhi soni
#2 3090998-translation-is-not-supported-in-file-module-2.patch801 bytessimbaw

Issue fork drupal-3090998

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

simbaw created an issue. See original summary.

simbaw’s picture

simbaw commented
Status: Active » Needs review
StatusFileSize
new 3090998-translation-is-not-supported-in-file-module-2.patch801 bytes

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

borisson_’s picture

borisson_
Primary language Dutch
Location Mechelen, 🇧🇪
commented
Status: Needs review » Needs work
Issue tags: +Needs tests

This still applies, which is very unexpected, it however does not have any tests, so adding that tag.

rakhi soni’s picture

rakhi soni commented
Status: Needs work » Needs review
StatusFileSize
new Translation-is-not-supported-in-file-module-3090998-9.patch807 bytes

Kindly review patch for version 9.4x,,

borisson_’s picture

borisson_
Primary language Dutch
Location Mechelen, 🇧🇪
commented
Status: Needs review » Needs work

@Rakhi Soni this is exactly the same patch as #2, so this is not helpful.

In order to commit a bug fix we need an automated to test to prove that we've fixed the bug and ensure that we don't break it again in the future. For more information about writing tests in Drupal 8 see the following links:

  1. https://www.drupal.org/docs/8/testing
  2. https://api.drupal.org/api/drupal/core%21core.api.php/group/testing/8.7.x

I can't stop the test infrastructure, but I'll set it back to needs work to make sure we add the tests.

bnjmnm’s picture

bnjmnm
he/him
Primary language English
Location Ann Arbor, MI
commented

Pre-emptively removing credit for #9 since it was an identical patch (i.e. unnecessary reroll)

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

mohit_aghera’s picture

mohit_aghera commented
Issue summary: View changes
Issue tags: +Bug Smash Initiative

mohit_aghera opened merge request !12458

mohit_aghera’s picture

mohit_aghera commented
Status: Needs work » Needs review
mohit_aghera’s picture

mohit_aghera commented
mohit_aghera’s picture

mohit_aghera commented
smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work

Left some comments on the MR but think adding return types to the content_translation module seem out of scope of the issue at hand.

mohit_aghera’s picture

mohit_aghera commented

True that.
However, if I don't add those, phpstan is failing for our test case class.
Job https://git.drupalcode.org/issue/drupal-3090998/-/jobs/5656011 has more information.

mohit_aghera’s picture

mohit_aghera commented
Status: Needs work » Needs review
oily’s picture

oily commented
Issue tags: -Needs tests
smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community
Issue tags: +Needs Review Queue Initiative

Thanks @oily but I reverted that change as it was out of scope and not related to this ticket.

I couldn't get the test-only job to run, was throwing some errors so I ran it locally

Behat\Mink\Exception\ExpectationException: Current response status code is 403, but 200 expected.
/var/www/html/vendor/behat/mink/src/WebAssert.php:888
/var/www/html/vendor/behat/mink/src/WebAssert.php:145
/var/www/html/core/modules/file/tests/src/Functional/PrivateFileOnTranslatedEntityTest.php:193

Switching to check the translation makes sense.

oily’s picture

oily commented

@smustgrave Thanks for reverting I agree with it (in hindsight)- seemed a good idea at the time : ).

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented

#2887696: Access denied to published private file if original translation is unpublished has been closed in favor of this - should be checked, if it's really duplicates.

catch’s picture

catch
he/him
Primary language English
commented
Status: Reviewed & tested by the community » Needs work

One question on the MR, also has merge conflicts.

herved made their first commit to this issue’s fork.

herved’s picture

herved commented
StatusFileSize
new 3090998-28.diff3.63 KB

I rebased the MR on 11.x, I had to drop some commits and reverts that were causing conflicts so it'll be easier to rebase later.
We were previously using #2887696: Access denied to published private file if original translation is unpublished on our project but I can confirm this solution also covers it.
Also attaching static patch for composer.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

herved’s picture

herved commented
Status: Needs work » Needs review
StatusFileSize
new 3090998-30.diff3.92 KB

MR rebased, looks good IMO, moving to needs review and attaching current snapshot.

smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work

Super small comment on MR. Rest LGTM.