Problem/Motivation

As part of #3221796: [META] Modernise file upload logic it was identified CKEditor5ImageController duplicates a lot of logic in FileUploadHandler. This has lead to bugs like #3372385: CKEditor file upload sets file URI prior to validation, causing validators to be unable to find the file.

In order to reduce the chances of bugs like this happening, we should make CKEditor5ImageController reuse FileUploadHandler.

Steps to reproduce

Proposed resolution

make CKEditor5ImageController reuse FileUploadHandler.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Issue fork drupal-3388985

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

kim.pepper created an issue. See original summary.

kim.pepper’s picture

kim.pepper’s picture

Status: Active » Needs review

Changed CKEditor5ImageController to use FileUploadHandler.

I needed to add two things to FileUploadHandler to support this:

  1. Added \Drupal\Core\File\FileSystemInterface::prepareDirectory() to create the destination sub-directory
  2. Added \Drupal\Core\Lock\LockBackendInterface::acquire() / ::release() which gets duplicated by JSON API and REST too, so we can move more logic to shared code in #3375423: Deprecate file_managed_file_save_upload(), file_save_upload() and _file_save_upload_from_form() and replace with a service
kim.pepper’s picture

I rolled back the changes to FileUploadHandler.

Probably the most complex bc handling constructor I have tried so far.

Created a new issue for #3389016: Add file upload lock handling to FileUploadHandler

smustgrave’s picture

Status: Needs review » Needs work

Seems failure could be related to change.

kim.pepper’s picture

Status: Needs work » Needs review
smustgrave’s picture

Status: Needs review » Needs work
Issue tags: +Needs change record updates

Sweet seeing all green! Tagging for CR

kim.pepper’s picture

Status: Needs work » Needs review
Issue tags: -Needs change record updates

Updated change record.

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Thanks @kim.pepper reads well.

wim leers’s picture

Component: file.module » ckeditor5.module

I didn't notice this because it's not in the component that the code actually lives in 😅

wim leers’s picture

Status: Reviewed & tested by the community » Needs work

Looks fantastic!

But, 2 questions, one of which is a bug in the logic (although it does not currently cause problems, hence the passing tests, but it'll make future maintenance more difficult/confusing).

wim leers’s picture

Would this make #3246260: Simplify CKEditor5ImageController once #2940383 lands obsolete too, or is that a further evolution of Drupal core's file upload handling?

kim.pepper’s picture

Status: Needs work » Needs review

Addressed all feedback.

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

All threads have been resolved.

smustgrave’s picture

Save credit to @Wim Leers for his review.

wim leers’s picture

RTBC++

kim.pepper’s picture

Status: Reviewed & tested by the community » Postponed

I think we should postpone on #3375447: Create an UploadedFile validator and deprecate error checking methods on UploadedFileInterface as we won't need to do the exception handling.

kim.pepper’s picture

kim.pepper’s picture

Title: Make CKEditor5ImageController reuse FileUploadHandler » [PP-1] Make CKEditor5ImageController reuse FileUploadHandler
larowlan’s picture

Title: [PP-1] Make CKEditor5ImageController reuse FileUploadHandler » Make CKEditor5ImageController reuse FileUploadHandler
Status: Postponed » Needs work

Blocker is in

kim.pepper’s picture

Status: Needs work » Needs review

Updated to use constraint violations.

kim.pepper’s picture

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Deprecation seems correct
CR is present and makes sense about what is now needed.

wim leers’s picture

Reviewed this in detail. It looks excellent :)

We have detailed test coverage for this:

  1. \Drupal\Tests\ckeditor5\Functional\ImageUploadTest::testUploadFileExtension()
  2. \Drupal\Tests\ckeditor5\Functional\ImageUploadTest::testFileUploadLargerFileSize()
  3. \Drupal\Tests\ckeditor5\Functional\ImageUploadTest::testLockAfterFailedValidation()

(Note that each of these asserts a 422 response is received when trying to upload something that is not allowed 👍

That's why I can confidently confirm this RTBC 😊

larowlan’s picture

Status: Reviewed & tested by the community » Needs work

Just one minor issue with the deprecation messages

kim.pepper’s picture

Status: Needs work » Reviewed & tested by the community

Back to RTBC (assuming green).

longwave’s picture

Title: Make CKEditor5ImageController reuse FileUploadHandler » [PP-1] Make CKEditor5ImageController reuse FileUploadHandler
Status: Reviewed & tested by the community » Postponed

While this is RTBC it is only a refactoring; #3280279: Allow sites to programmatically opt in to accept more image type uploads in CKEditor 5: TIFF, SVG… is a major feature request that wants to make changes to the controller constructor as well, and I think it is worth postponing this issue on that one in order to try and get that into 10.2.x first; this can only go into 10.3.x/11.x as the parent issue did not land in 10.2.x.

kim.pepper’s picture

Well, this is disappointing given its blocked on a feature request, while this is removing duplicate code which has been the cause of numerous bugs (including security issues).

I would argue this has higher priority.

larowlan’s picture

Yes, this fixes #3372385: CKEditor file upload sets file URI prior to validation, causing validators to be unable to find the file.

But because it relies on code from the parent issue that is 10.2 we're kind of hamstrung.

We might need to unpostpone #3372385: CKEditor file upload sets file URI prior to validation, causing validators to be unable to find the file. and reinstate the old approach there

wim leers’s picture

Title: [PP-1] Make CKEditor5ImageController reuse FileUploadHandler » Make CKEditor5ImageController reuse FileUploadHandler
Priority: Normal » Major
Status: Postponed » Reviewed & tested by the community
Issue tags: +Security improvements

I think there's been a misunderstanding here. #3375447: Create an UploadedFile validator and deprecate error checking methods on UploadedFileInterface did not actually land only in 11.x … because 10.2.x was branched from 11.x AFTER #3375447 landed! That is the confusing part here 😅

EDIT: I realized this only yesterday, at #3280279-53: Allow sites to programmatically opt in to accept more image type uploads in CKEditor 5: TIFF, SVG….

So: moving back to RTBC: this can land first just fine (and I think @kim.pepper's reasons above are sufficiently convincing — tagging accordingly), and then we can land the #3280279: Allow sites to programmatically opt in to accept more image type uploads in CKEditor 5: TIFF, SVG… afterwards 👍

longwave’s picture

Not at computer to check but that is not what I remember nor what #3375447-26: Create an UploadedFile validator and deprecate error checking methods on UploadedFileInterface says... which is why I would prefer to get the other issue in first before diverging 10.2.x and 10.3.x/11.x any further.

larowlan’s picture

See https://www.drupal.org/project/drupal/issues/3375447#comment-15284269 the other issue was 11.x only, I confirmed with git

I'll unpostpone #3372385: CKEditor file upload sets file URI prior to validation, causing validators to be unable to find the file.

I don't think we should postpone this on the feature addition though, this is a nice piece of cleanup for 11.x part of a larger string of criticals that consolidate file upload handling.

quietone’s picture

I read the issue summary and the comments. I did not find any unanswered questions or other work to do. I also think the change record is correct.

  • larowlan committed 60a38dae on 11.x
    Issue #3388985 by kim.pepper, Wim Leers: Make CKEditor5ImageController...
larowlan’s picture

Status: Reviewed & tested by the community » Fixed

Went to commit #3280279: Allow sites to programmatically opt in to accept more image type uploads in CKEditor 5: TIFF, SVG… first but it has a phpcs fail.

So this one wins the 'who goes in first' prize.

Committed to 11.x and published change record.

Unpostponed #3389016: Add file upload lock handling to FileUploadHandler

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

codebymikey made their first commit to this issue’s fork.

codebymikey changed the visibility of the branch 3388985-make-ckeditor5imagecontroller-reuse-10.1.x to hidden.

lendude’s picture

Since FileUploadHandler doesn't have an interface and this plugin now hardcodes the used class, you can no longer decorate the file.upload_handler service and use this plugin without fatal errors ¯\_(ツ)_/¯

larowlan’s picture

That seems worth an issue to add an interface

kim.pepper’s picture