Hi,

i have installed ckeditor in a drupal project with module storage_api, solving an issue with storage api i found some cases where a call to file_download_access can cause infinite calls with other modules interactions.

The code in function ckeditor_file_download, checks that the file is not managed, but first it create the url, than can cause problems (in fact it is doing with storage api), i think that the call to that function can be moved after checking that the file is not managed. It is also more efficient.

This is the actual code:

function ckeditor_file_download($uri) {

  if ($path = file_create_url($uri)) {
  $result = db_query("SELECT f.* FROM {file_managed} f WHERE uri = :uri", array(':uri' => $uri));
  foreach ($result as $record) {
    return NULL;
  }
  //No info in DB? Probably a file uploaded with FCKeditor / CKFinder

I send a patch moving the if after firsts foreach:

function ckeditor_file_download($uri) {
  $result = db_query("SELECT f.* FROM {file_managed} f WHERE uri = :uri", array(':uri' => $uri));
  foreach ($result as $record) {
    return NULL;
  }
  //No info in DB? Probably a file uploaded with FCKeditor / CKFinder
  if ($path = file_create_url($uri)) {

Best
David

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

david.gil’s picture

here is my patch.

Best

Perignon’s picture

Adding a related issue. This patch fixes issues where modules implement file access restrictions. Storage API's recent update implements better file access checking. Users using CKEditor module immediately had problems and issues when the security fix was put in place for Storage API.

Perignon’s picture

Status: Active » Reviewed & tested by the community

Marking as reviewed as some users of Storage API and myself have checked this patch.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 1: ckeditor-move_check_file_download-2437749-1.patch, failed testing.

Perignon’s picture

Hrm. I'm going to recheck that patch. See if it might need re-rolling.

Perignon’s picture

I see the problem on the patch. It wasn't made against the module repo but the guys site installation. Rerolling...

Perignon’s picture

Version: 7.x-1.16 » 7.x-1.x-dev
Status: Needs work » Reviewed & tested by the community
FileSize
5.01 KB

Attached is a re-rolled patch. Patch also fixes three or four coding standards things (one line IF statements) and more than one empty line at the end.

pdcarto’s picture

#7 patch solved the problem for me

SergFromSD’s picture

#7 patched aslo solved the problem I had with storage api.

  • jcisio committed 1415a51 on 7.x-1.x authored by Perignon
    Issue #2437749 by Perignon, david.gil, jcisio: Infinity bucle in some...
jcisio’s picture

Status: Reviewed & tested by the community » Fixed

I've removed all unnecessary change (to avoid conflict with #2550535: $plugin_settings['active'] is messing with features.) from the patch and committed it. Thanks.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.