I am using the field collection to group two file fields, I get an access denied message when I try to access the files. When I use the same field not grouped under field collection, I don't have a problem. Is this a known issue?

Comments

tim.plunkett’s picture

tim.plunkett
he/him
Primary language English
Location Philadelphia
CreditAttribution: tim.plunkett commented
Priority: Critical » Normal
Status: Active » Postponed (maintainer needs more info)

This isn't a known issue. Can you please elaborate on clearer steps to reproduce?

drupalnuts’s picture

drupalnuts CreditAttribution: drupalnuts commented
Status: Postponed (maintainer needs more info) » Active

I am using
field_collection, media, file_field and content_access.

I have a field collection item that has 3 fields, 1 of them is a file upload in the private file system.

It is attached to a node, that is accessible by all users (authenticated and anonymous )

When anonymous users try to download the file that is in the private file system, they get an access denied.

If I attach the field directly to the node entity, and bypass field_collection, it works correctly.

thisisjoe’s picture

thisisjoe CreditAttribution: thisisjoe commented

Experiencing the same issue.

Using Content Access to control permissions for the node. The content type contains a field collection; the collection contains a file field, which is uploaded to a private folder.

Despite various configurations of the access control for the node, the file is not downloadable by anyone except for adminstrators or those with "[Node] Bypass content access control" enabled. The response is 403/"Access Denied". Log also adds "access denied" event.

yultyyev’s picture

yultyyev CreditAttribution: yultyyev commented

I have same troubles. It seems very strange. On my localhost with Drupal 7.22 I get 403 error when access private file with private file system (using field access) and get a file when field access value set to public. And on the server with Drupal 7.23 everytime when access to file (public field/private field and private file system) get 403 error.

BarisW’s picture

BarisW CreditAttribution: BarisW at LimoenGroen commented
Issue summary: View changes

I think I found the problem; private files that are uploaded in a field collection should compare the file owner with the host entity owner, not with the file owner.

This fixes it for me:

<?php
/**
 * Implements hook_file_entity_access().
 */
function MYMODULE_file_entity_access($op, $file, $account) {
  if (file_uri_scheme($file->uri) == 'private') {
    foreach (file_usage_list($file) as $file_usage) {
      if (isset($file_usage['field_collection_item'])) {
        foreach ($file_usage['field_collection_item'] as $fcid => $revision_count) {
          $field_collection_item = field_collection_item_load($fcid);
          $host_entity = $field_collection_item->hostEntity();
          if ($account->uid == $host_entity->uid) {
            return FILE_ENTITY_ACCESS_ALLOW;
          }
        }
      }
    }
  }
}
?>