Problem/Motivation

An owner can edit or delete a vault file but has no way to view its contents: only records have a View action, files do not, and the Edit form shows the filename as plain text. There is a consumer-facing raw endpoint (pdv_server_api), but nothing owner-session-facing.

Proposed resolution

  • Add an owner-only route pdv.item.download (/vault/item/{pdv_item}/download): it decrypts the file and serves the bytes with the stored MIME. Inline for a safe allowlist (images, PDF, plain text) so they render in the browser; attachment for everything else, so an uploaded HTML/SVG cannot run script in the owner session. X-Content-Type-Options: nosniff and no-store.
  • Add a View action to the Files list and link the Edit form filename to the same route (opens in a new tab).
  • A locked vault is handled by the locked-vault redirect subscriber (#3594933): the View link redirects to unlock and returns to the file afterward, rather than erroring.

Remaining tasks

  • Review.
  • Merge.

Issue fork pdv-3594963

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

mably created an issue. See original summary.

mably opened merge request !39

mably’s picture

mably commented
Status: Active » Needs review
mably’s picture

mably commented
Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • mably committed addf05ea on 1.x 
    feat: #3594963 Let owners view a vault file from the Files list and the...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.