The public stream wrapper can no longer be used to access private files if the private files directory is inside the public files directory

Some sites have the private files directory inside the public files directory (e.g. drupal/sites/files/private). Due to a file field misconfiguration or other issue, some such sites might be relying on unrestricted access being allowed to files inside the private directory, which should no longer be possible after SA-CORE-2022-012.

If parts of your file or image content become inaccessible after this release, add the following line to your site's settings.php:

$settings['sa_core_2022_012_override'] = TRUE;

This setting is a temporary backwards-compatibility layer for misconfigured sites and will be removed in a future release. In the long term, you should migrate your uploaded files to the correct public or private directories.

1. Visit /admin/reports/fields
2. Under the Field type column, look for fields labeled things like File (module: file) or Image (module: image).
3. For each file or image field check its file upload directory, click the link to the entity under the Used in column.
4. Select Field Settings from the dropdown in the row for the file or image field.
5. Under Upload destination, review whether the field is intended to use public or private file uploads.
6. Click on the Edit tab and look at the File directory field. If this content is supposed to be public, ensure the upload directory is not set with a path to a private files directory.
7. If any file or image fields were misconfigured, migrate the content to the correct directories.