Needs work
Project:
YouTube Field
Version:
7.x-1.x-dev
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
23 Feb 2017 at 01:26 UTC
Updated:
26 Apr 2019 at 16:21 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #2
rosk0Provided patch fixes this issue.
Comment #3
goldThis is looking good.
Thumbnails are now being generated as expected.
Comment #4
imyaro commentedHello,

Field "YouTube thumbnail directory" has the public files path prefix,
and problem could appear if:
* Site has the private files directory within the public one
* User has selected private files directory to store the thumbnails.
Only in this case you will have this issue.
And if module user has selected private files directory, he has a reason to hide this files from the users which don't have this permission.
Comment #5
imyaro commentedWorks as designed, nothing to fix there.
Comment #6
rosk0Hi @zvse,
Yes, you are completely right, if the user specifies private file system for thumbnails then only users with required access rights should be able to view thumbnails.
The issue is that without this patch they don't.
Comment #7
imyaro commentedIn this case we have issues:
1) In the hook we don't check if user has an access to the field content (to the entity, at least). We just give all the users access to the thumbnails in any case.
2) We don't allow users to define
private://file directory in case if it located outside the public one.Comment #8
prudloff commentedWe had the same issue on a Drupal 8 website but got it to work with a simple download hook: