diff --git a/core/modules/file/src/FileAccessControlHandler.php b/core/modules/file/src/FileAccessControlHandler.php index 07f9cecc92ed3054a9d30138a8de0cfef0cd33e2..3c26b1da7f7cc2d38ce4c2d36374b43ca5790573 100644 --- a/core/modules/file/src/FileAccessControlHandler.php +++ b/core/modules/file/src/FileAccessControlHandler.php @@ -64,11 +64,11 @@ protected function checkAccess(EntityInterface $entity, $operation, AccountInter if ($operation == 'delete' || $operation == 'update') { $account = $this->prepareUser($account); $file_uid = $entity->get('uid')->getValue(); - // Only the file owner can delete and update the file entity. + // Only the file owner can update or delete the file entity. if ($account->id() == $file_uid[0]['target_id']) { return AccessResult::allowed(); } - return AccessResult::forbidden(); + return AccessResult::forbidden('Only the file owner can update or delete the file entity.'); } // No opinion. diff --git a/core/modules/rest/tests/src/Functional/EntityResource/File/FileResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/File/FileResourceTestBase.php index 267f45321ea1c6bda55fc36d5471e42faac3e287..0ccf2ecdae1e1b028c09b0a06a48eb48d0376aa3 100644 --- a/core/modules/rest/tests/src/Functional/EntityResource/File/FileResourceTestBase.php +++ b/core/modules/rest/tests/src/Functional/EntityResource/File/FileResourceTestBase.php @@ -224,8 +224,8 @@ protected function getExpectedUnauthorizedAccessMessage($method) { if ($method === 'GET') { return "The 'access content' permission is required."; } - if ($method === 'PATCH') { - return 'You are not authorized to update this file entity.'; + if ($method === 'PATCH' || $method === 'DELETE') { + return 'Only the file owner can update or delete the file entity.'; } return parent::getExpectedUnauthorizedAccessMessage($method); }