Problem/Motivation

If you run a site with modules also implementing hook_file_entity_access() and you want to restrict access to files without specifically returning FILE_ENTITY_ACCESS_DENY this is impossible with the commerce_file module enabled.
This is because commerce_file_file_entity_access() too easily grands access to files which aren't licensed.

Proposed resolution

Check earlier in commerce_file_file_entity_access() if the file is licensable, to be able to return FILE_ENTITY_ACCESS_IGNORE when the file is not licensable.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

dmsmidt’s picture

And a patch fixing this issue.