Unverified Commit c31dedaf authored by Alex Pott's avatar Alex Pott
Browse files

fix: #1452100 Private file download returns access denied, when file attached... 

fix: #1452100 Private file download returns access denied, when file attached to revision other than current

By: jlongbottom
By: berdir
By: therainmakor
By: gapple
By: benjy
By: cilefen
By: eiriksm
By: cristiroma
By: leontin
By: amateescu
By: drenton
By: shubhangi1995
By: acbramley
By: catch
By: alexpott
By: fenstrat
By: larowlan
By: mxr576
By: rakshith.thotada
By: kim.pepper
By: richard.thomas
By: effulgentsia
By: lauriii
By: xjm
By: nicxvan
parent 39756780

core/.phpstan-baseline.php

+0 −6
Original line number Diff line number Diff line
@@ -13753,12 +13753,6 @@ 
	'count' => 1,

	'path' => __DIR__ . '/modules/file/src/FileUsage/FileUsageInterface.php',

];

$ignoreErrors[] = [

	'message' => '#^Parameter \\#4 \\$field_type of function file_get_file_references expects string, null given\\.$#',

	'identifier' => 'argument.type',

	'count' => 1,

	'path' => __DIR__ . '/modules/file/src/Hook/FileDownloadHook.php',

];

$ignoreErrors[] = [

	'message' => '#^Variable \\$rows in empty\\(\\) always exists and is not falsy\\.$#',

	'identifier' => 'empty.variable',

core/includes/bootstrap.inc

+7 −0
Original line number Diff line number Diff line
@@ -441,6 +441,13 @@ function drupal_static_reset($name = NULL): void { 
    case 'filter_formats':

      @trigger_error("Using drupal_static_reset() with 'filter_formats' as argument is deprecated in drupal:11.4.0 and is removed from drupal:13.0.0. No replacement is provided. See https://www.drupal.org/node/3035368", E_USER_DEPRECATED);

      break;



    case 'file_get_file_references':

    case 'file_get_file_references:field_columns':

      @trigger_error("Calling drupal_static_reset() with \"$name\" as argument is deprecated in drupal:11.4.0 and is removed from drupal:13.0.0. Use \Drupal::service('cache.memory')->invalidateTags(['file_references']) instead. See https://www.drupal.org/node/3573884", E_USER_DEPRECATED);

      \Drupal::service('cache.memory')->invalidateTags(['file_references']);

      break;



  }

  drupal_static($name, NULL, TRUE);

}

core/modules/editor/src/Hook/EditorHooks.php

+3 −3
Original line number Diff line number Diff line
@@ -272,8 +272,8 @@ public function entityRevisionDelete(EntityInterface $entity): void { 
  /**

   * Implements hook_file_download().

   *

   * @see file_file_download()

   * @see file_get_file_references()

   * @see \Drupal\file\Hook\FileDownloadHook

   * @see \Drupal\file\FileReferenceResolver::getReferences()

   */

  #[Hook('file_download')]

  public function fileDownload($uri): array|int|null {
@@ -300,7 +300,7 @@ public function fileDownload($uri): array|int|null { 
    // Editor.module MUST NOT call $file->access() here (like

    // file_file_download() does) as checking the 'download' access to a file

    // entity would end up in FileAccessControlHandler->checkAccess() and

    // ->getFileReferences(), which calls file_get_file_references(). This

    // \Drupal\file\FileReferenceResolver::getReferences(). This

    // latter one would allow downloading files only handled by the file.module,

    // which is exactly not the case right here. So instead we must check if the

    // current user is allowed to view any of the entities that reference the

core/modules/file/file.module

+12 −0
Original line number Diff line number Diff line
@@ -320,8 +320,14 @@ function file_managed_file_save_upload($element, FormStateInterface $form_state) 
 *   entity_id and the value is an entity referencing this file.

 *

 * @ingroup file

 *

 * @deprecated in drupal:11.4.0 and is removed from drupal:13.0.0. Use

 *   \Drupal::service(\Drupal\file\FileReferenceResolver::class) instead.

 *

 * @see https://www.drupal.org/node/3573884

 */

function file_get_file_references(FileInterface $file, ?FieldDefinitionInterface $field = NULL, $age = EntityStorageInterface::FIELD_LOAD_REVISION, $field_type = 'file') {

  @trigger_error(__FUNCTION__ . ' is deprecated in drupal:11.4.0 and is removed from drupal:13.0.0. Use \Drupal::service(\Drupal\file\FileReferenceResolver::class)->getReferences($file) instead. See https://www.drupal.org/node/3573884', E_USER_DEPRECATED);

  $references = &drupal_static(__FUNCTION__, []);

  $field_columns = &drupal_static(__FUNCTION__ . ':field_columns', []);
@@ -397,8 +403,14 @@ function file_get_file_references(FileInterface $file, ?FieldDefinitionInterface 
 * @return bool

 *   The field column if the field references {file_managed}.fid, typically

 *   fid, FALSE if it does not.

 *

 * @deprecated in drupal:11.4.0 and is removed from drupal:13.0.0. There is no

 *   replacement.

 *

 * @see https://www.drupal.org/node/3573884

 */

function file_field_find_file_reference_column(FieldDefinitionInterface $field) {

  @trigger_error(__FUNCTION__ . ' is deprecated in drupal:11.4.0 and is removed from drupal:13.0.0. There is no replacement. See https://www.drupal.org/node/3573884', E_USER_DEPRECATED);

  $schema = $field->getFieldStorageDefinition()->getSchema();

  foreach ($schema['foreign keys'] as $data) {

    if ($data['table'] == 'file_managed') {

core/modules/file/file.services.yml

+1 −0
Original line number Diff line number Diff line
@@ -34,3 +34,4 @@ services: 
  Drupal\file\EventSubscriber\DefaultContentSubscriber:

    calls:

      - [setLogger, ['@logger.channel.file']]

  Drupal\file\FileReferenceResolver: ~