In looking through the code, honeypot_create_css makes an assumption that the default file scheme is `public://`. While this is true for the large majority of sites, it isn't a 100% constant and some sites may choose to use other file storage locations for various reasons. There is no guarantee that `public://` is actually shared across all web nodes.
I'd like to propose using variable_get('file_default_scheme', 'public') rather than hard-coding `public` into the module. This provides flexibility moving forward for site owners/devs to use a different file storage mechanism, such as S3, if they so desire.
Additional note: I'm filing this as a feature request even though I originally considered filing it as a bug (specifically the part about assuming `public://`). However, I feel that the use case I'm presenting is a bit edge-case-ish so I moved it to a feature request rather than a bug report. For the large majority of people using this module, this change is likely irrelevant to them.
| Comment | File | Size | Author |
|---|---|---|---|
| #8 | honeypot-file_default_scheme-2696219-8.patch | 449 bytes | geerlingguy |
| #4 | honeypot-file_default_scheme-2696219-4-7.x.patch | 1.82 KB | rvtraveller |
Comments
Comment #2
rvtraveller commentedI'm working on a patch for this.
Comment #3
geerlingguy commentedSounds good to me!
Comment #4
rvtraveller commentedPatch attached including a test.
Comment #5
geerlingguy commentedComment #6
geerlingguy commentedThere's one more usage assuming public:// inside the install file, that I'll fix after merging the patch from #4.
Comment #8
geerlingguy commentedExtra patch attached.
Comment #10
geerlingguy commentedConfirmed D8 is good to go, so this is Fixed. Thanks especially to @rvtraveller!
Comment #12
mbnsorg commentedWe are having an issue related to this change in 7.x-1.24 release. We use default file scheme private, and now that the honeypot.css file is switched to the private scheme (ownership/permissions required), honeypot fields are visible on the forms because access is denied to the "system/files/honeypot/honeypot.css" file. Is there a recommended solution for this?
We will rollback to 1.23 for now. Would rather not have to install another module like https://www.drupal.org/project/private_files_download_permission just for this file.