Verified Commit af3a8ef5 authored by Lauri Timmanee's avatar Lauri Timmanee
Browse files

Issue #3079235 by acbramley, amjad1233, keshav.k, oknate: Media Library image... 

Issue #3079235 by acbramley, amjad1233, keshav.k, oknate: Media Library image style shouldn't be able to be deleted through the UI
parent 96ac98b6

core/modules/image/image.routing.yml

+1 −1
Changes for core/modules/image/image.routing.yml: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -20,7 +20,7 @@ entity.image_style.delete_form: 
    _entity_form: 'image_style.delete'

    _title: 'Delete'

  requirements:

    _permission: 'administer image styles'

    _entity_access: 'image_style.delete'



entity.image_style.flush_form:

  path: '/admin/config/media/image-styles/manage/{image_style}/flush'

core/modules/media_library/tests/src/Functional/MediaLibraryImageStyleAccessTest.php

0 → 100644
+49 −0
Changes for core/modules/media_library/tests/src/Functional/MediaLibraryImageStyleAccessTest.php: 49 added lines, 0 removed lines.
Original line number Diff line number Diff line 
<?php



namespace Drupal\Tests\media_library\Functional;



use Drupal\image\Entity\ImageStyle;

use Drupal\Tests\BrowserTestBase;



/**

 * Tests access to the Media library image style.

 *

 * @group media_library

 */

class MediaLibraryImageStyleAccessTest extends BrowserTestBase {



  /**

   * {@inheritdoc}

   */

  protected static $modules = ['media_library'];



  /**

   * {@inheritdoc}

   */

  protected $defaultTheme = 'stark';



  /**

   * Tests that users can't delete the 'media_library' image style.

   */

  public function testMediaLibraryImageStyleAccess(): void {

    // Create a user who can manage the image styles.

    $user = $this->createUser([

      'access administration pages',

      'administer image styles',

    ]);



    // The user should be able to delete the 'medium' image style, but not the

    // 'media_library' image style.

    $medium = ImageStyle::load('medium');

    $this->assertTrue($medium->access('delete', $user));

    $mediaLibrary = ImageStyle::load('media_library');

    $this->assertFalse($mediaLibrary->access('delete', $user));



    $this->drupalLogin($user);

    $this->drupalGet($medium->toUrl('delete-form'));

    $this->assertSession()->statusCodeEquals(200);

    $this->drupalGet($mediaLibrary->toUrl('delete-form'));

    $this->assertSession()->statusCodeEquals(403);

  }



}

core/modules/media_library/tests/src/Kernel/MediaLibraryAccessTest.php

+0 −17
Changes for core/modules/media_library/tests/src/Kernel/MediaLibraryAccessTest.php: 0 added lines, 17 removed lines.
Original line number Diff line number Diff line
@@ -8,7 +8,6 @@ 
use Drupal\entity_test\Entity\EntityTestBundle;

use Drupal\field\Entity\FieldConfig;

use Drupal\field\Entity\FieldStorageConfig;

use Drupal\image\Entity\ImageStyle;

use Drupal\KernelTests\KernelTestBase;

use Drupal\media_library\MediaLibraryState;

use Drupal\Tests\media\Traits\MediaTypeCreationTrait;
@@ -84,22 +83,6 @@ protected function setUp(): void { 
    $this->createUser([]);

  }



  /**

   * Tests that users can't delete the 'media_library' image style.

   */

  public function testMediaLibraryImageStyleAccess() {

    // Create a user who can manage the image styles.

    $user = $this->createUser([

      'access administration pages',

      'administer image styles',

    ]);



    // The user should be able to delete the 'medium' image style, but not the

    // 'media_library' image style.

    $this->assertTrue(ImageStyle::load('medium')->access('delete', $user));

    $this->assertFalse(ImageStyle::load('media_library')->access('delete', $user));

  }



  /**

   * Tests that the field widget opener respects entity creation permissions.

   */