Incorrect permission checking for multiple upload form

thanks

+++ b/includes/media.pages.incundefined
@@ -64,7 +64,7 @@ function media_file_page_edit_multiple($files) {
+    '#href' => isset($_GET['destination']) ? $_GET['destination'] : (user_access('administer files') ? 'admin/content/file' : '<front>'),

this should be splitted to an if/else statement..it would be easier to read

+++ b/media.moduleundefined
@@ -595,6 +596,27 @@ function media_file_download_access($field, $entity_type, $entity) {
+/**
+ * Access callback for the media-multi form
+ * ¶
+ * @param $files
+ *   An array of files being editing on the multiform.
+ * @return
+ *   TRUE if the current user has access to edit all of the files, otherwise FALSE.
+ */
+function media_multi_form_access($files) {
+  // Check that the current user can edit each file
+  if (!empty($files)) {
+    foreach ($files as $file) {
+      if (!file_entity_access('update', $file)) {
+        return FALSE;
+      }
+    }
+    return TRUE;
+  }
+  return FALSE;
+}

maybe you should expose the $op as argument here instead of hardcoding it to 'update', so this function becomes even more reusable.

Also maybe rename it to _media_file_entity_access_recursive

Marked #2015787: Access Denied errors when importing bulk media as a duplicate.

Could anyone provide advice on looking into how to backport this patch for 1.3?

Looking at the patch I found the places in the media.module to edit, but I cannot find the lines for /includes/media.pages.inc and I can't find the entity file patch from here #1870532: (https://drupal.org/node/1870532) at all.

Should the suggestion in #4 be included in the patch in #3 as a new whole patch?

Hello,

Do you include this patch in the next version of media?
in Media 7.x-2.0-alpha2 this patch is not present.

Thanks.

Marked #2072079: Permission denied for «Edit Multiple» Files as a duplicate.

change from #4

For me #10 gave the expected results. Nice job! :-)

Committed to http://drupalcode.org/project/media.git/commit/fbdaf45