Problem/Motivation

Administrator cannot access to temporary files without usage that are owned by other users

Steps to reproduce

1. Create a image field in content type.
2. Create a node and upload a image but not save the node.
3. Access to /admin/content/files and the image file is temporary and file usage is 0
4. Click the file link, got Access Deny.

Proposed resolution

Add role check logic in file_file_download function.
If user is the Administrator, allowed to access the file.Instead of just only checking whether the file owner is the same as the current user.

CommentFileSizeAuthor
#2 3389028-administrator-cannot-access-file-issue.patch1.37 KBconnbi

Issue fork drupal-3389028

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

bijiaxing created an issue. See original summary.

connbi’s picture

connbi commented
StatusFileSize
new 3389028-administrator-cannot-access-file-issue.patch1.37 KB
cilefen’s picture

cilefen commented
Status: Active » Needs review
Related issues: +#2949017: There is no way to delete file entities of other users
smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work
Issue tags: +Needs tests

Thank you for reporting

Believe next steps would be to add a test case to show the issue and that the patch addresses it.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

caesius’s picture

caesius commented

I have a custom module that generates PDF with a temporary status (deliberate, since they're supposed to be ephemeral downloads) and only user 1 was able to access them. Using this patch allows other admin users to view the generated PDFs.

samitk made their first commit to this issue’s fork.

samitk’s picture

samitk commented
Issue tags: +Needs usability review

This patch does not apply to Drupal 11.x or the current main branch, as file_file_download() has been removed from core.

In Drupal 11+ and Drupal 12, file download access is handled via entity access control in core/modules/file/src/FileAccessControlHandler.php, rather than procedural file download functions.

The access logic would need to be implemented as part of the file entity’s download access check.

Adding this for discussion and feedback from others on the preferred approach.