Problem/Motivation
When both this module and the Media Entity Download module are installed the media download URL throws an access denied when downloading public files. The reason this happens is:
- Media Entity Download invokes hook_file_download() and respects the permission, even if it's downloading a public file
- pfdp returns -1 by default if it can't match any other access conditions
Steps to reproduce
- Set up a site with both media_entity_download and pfdp installed (as well as any dependencies like media itself)
- Ensure you have an unprivileged user without permissions that would give them access to private files (a standard anonymous or authenticated user should be fine out of the box)
- Create at least one media file
- Try to visit the media download URL for this file using your unprivileged user
- You should see an access denied page
Proposed resolution
I can think of two ways to resolve this - either have media_entity_download ignore hook_file_download access results for public files or have pfdp grant access for public files. I'm leaning toward the latter and will attach an MR for that shortly.
It's a naive check for file uris starting with public://. I know that, e.g., flysystem can provide alternate URLs for public/private files so this may be an imperfect solution. I'm not sure if there's some way in Drupal core to check if a URI is public vs private that would account for that.
Issue fork private_files_download_permission-3220820
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
dylan donkersgoed commentedComment #4
zanonmark commentedComment #5
zanonmark commentedComment #7
zanonmark commentedThanks Dylan for Your contribution.
I just added a NULL return value for clarity.
Could You please confirm the -dev version is ok now?
Thanks,
MZ