Problem/Motivation

When both this module and the Media Entity Download module are installed the media download URL throws an access denied when downloading public files. The reason this happens is:

  • Media Entity Download invokes hook_file_download() and respects the permission, even if it's downloading a public file
  • pfdp returns -1 by default if it can't match any other access conditions

Steps to reproduce

  1. Set up a site with both media_entity_download and pfdp installed (as well as any dependencies like media itself)
  2. Ensure you have an unprivileged user without permissions that would give them access to private files (a standard anonymous or authenticated user should be fine out of the box)
  3. Create at least one media file
  4. Try to visit the media download URL for this file using your unprivileged user
  5. You should see an access denied page

Proposed resolution

I can think of two ways to resolve this - either have media_entity_download ignore hook_file_download access results for public files or have pfdp grant access for public files. I'm leaning toward the latter and will attach an MR for that shortly.

It's a naive check for file uris starting with public://. I know that, e.g., flysystem can provide alternate URLs for public/private files so this may be an imperfect solution. I'm not sure if there's some way in Drupal core to check if a URI is public vs private that would account for that.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

Dylan Donkersgoed created an issue. See original summary.

dylan donkersgoed’s picture

Issue summary: View changes
Status: Active » Needs review
zanonmark’s picture

Assigned: Unassigned » zanonmark
Category: Bug report » Feature request
zanonmark’s picture

Category: Feature request » Bug report
Status: Needs review » Active

zanonmark’s picture

Status: Active » Fixed

Thanks Dylan for Your contribution.
I just added a NULL return value for clarity.

Could You please confirm the -dev version is ok now?

Thanks,
MZ

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.