The Media Browser widget will always permit any supported URI scheme, ignoring the options set for the content type.

Files: 
CommentFileSizeAuthor
#7 media-remove-disallowed-schemes-1289680-07.patch1.52 KBDevin Carlson
PASSED: [[SimpleTest]]: [MySQL] 922 pass(es).
[ View ]
#3 media_field_option_schemes.png35.79 KBsmartinm

Comments

arthurf’s picture

Assigned:Unassigned» arthurf

Investigating

arthurf’s picture

Assigned:arthurf» Unassigned
Status:Active» Closed (duplicate)

There is an overlap with #1201924 Marking this a a duplicate and closing.

smartinm’s picture

Status:Closed (duplicate)» Active
StatusFileSize
new35.79 KB

I think this issues is not related to #1201924: Widget does not respect settings in file_field_instance_settings_form (uri scheme, directory, extensions, file size).

The media field setting "Allowed URI schemes" (allowed_schemes) is totally ignored. I think it's never been implemented.

The patch in comment #30 from related issue:

     '#media_options' => array(
       'global' => array(
         'types' => array_filter($instance['widget']['settings']['allowed_types']),
-        // @todo: Not implemented
         'schemes' => $instance['widget']['settings']['allowed_schemes'],
+        'file_directory' => $instance['settings']['file_directory'],
+        'file_extensions' => $instance['settings']['file_extensions'],
+        'max_filesize' => $instance['settings']['max_filesize'],
+        'uri_scheme' => $field['settings']['uri_scheme'],
       ),
     ),

But the schemes global option is never used in the code.

xcafebabe’s picture

I'm facing the same issue described by @smartinm in #3.

If you select only the private uri scheme, images uploaded by media browser are always stored in the public folder. This happens with Media version 7.x-2.0-unstable6+70-dev

This issue is related with #1201924: Widget does not respect settings in file_field_instance_settings_form (uri scheme, directory, extensions, file size) but the patch proposed in comment #30 on that issue does not match with the current code in branch 7-x-2.x

TechNikh’s picture

same issue here. though the file field is configured to be private, the uri scheme in the database shows public://

Devin Carlson’s picture

Devin Carlson’s picture

Component:Media Browser» Code
Issue summary:View changes
Status:Active» Needs review
Related issues:+#2217841: Scheme selection form provides options not allowed by the field settings
StatusFileSize
new1.52 KB
PASSED: [[SimpleTest]]: [MySQL] 922 pass(es).
[ View ]

A patch to ensure that the upload destination scheme is one of the allowed schemes.

For the related File entity issue, see #2217841: Scheme selection form provides options not allowed by the field settings.

Dave Reid’s picture

Status:Needs review» Fixed

Committed #7 to 7.x-2.x.

Status:Fixed» Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.