When using a private filesystem, neither files nor images work, because file_get_file_references() is still severely broken.

#846296: file_file_download() only implements access checks for nodes and users tested part of file_get_file_references(), but not the part where the check is done across all the fields (ie. $field is NULL).

CommentFileSizeAuthor
#5 867928-file-tests-d7.patch3.12 KBandypost
#2 867928-file-private-downloads-broken.patch905 bytesdamien tournoud

Comments

damien tournoud’s picture

damien tournoud commented

This was noted in the original post of #846296: file_file_download() only implements access checks for nodes and users.

damien tournoud’s picture

damien tournoud commented
Status: Active » Needs review
StatusFileSize
new 867928-file-private-downloads-broken.patch905 bytes

The correct fix is simply, but we need a test of this.

andypost’s picture

andypost
he/him
Primary language Russian
commented
Status: Needs review » Reviewed & tested by the community

Tested, works!

dries’s picture

dries commented
Priority: Critical » Normal
Status: Reviewed & tested by the community » Needs work
Issue tags: +Needs tests

Committed to CVS HEAD but setting to 'needs work' because we still need a test.

andypost’s picture

andypost
he/him
Primary language Russian
commented
Status: Needs work » Needs review
Issue tags: -Needs tests
StatusFileSize
new 867928-file-tests-d7.patch3.12 KB

Extended tests:
- Added check that file downloadable for public scheme
- Added check for changing 'uri_scheme' setting
- Added check for private method download works

damien tournoud’s picture

damien tournoud commented
Status: Needs review » Reviewed & tested by the community

Looks good!

int’s picture

int commented
Status: Reviewed & tested by the community » Fixed

Commit #402088 by Dries at 04:50
- Patch #867928 by Damien Tournoud, andypost: more tests for file and image handling.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.