Issue #3239611: Download access to files on public filesystems should always be allowed

Switching to merge into 2.1.x branch

flysystem.module

@@ -5,7 +5,12 @@
  * Provides access to various filesystem backends using Flysystem.
  */
 
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Site\Settings;
 use Drupal\Core\StreamWrapper\StreamWrapperManager;
+use Drupal\file\FileInterface;
 
 /**
  * Implements hook_cron().
@@ -41,3 +46,36 @@ function flysystem_file_download($uri) {
     'Content-Length' => filesize($uri),
   ];
 }
+
+/**
+ * Implements hook_entity_access().
+ * @see Drupal\file\FileAccessControlHandler
+ */
+function flysystem_entity_access(EntityInterface $entity, $operation, AccountInterface $account) {
+    if (!$entity instanceof FileInterface) {
+        return AccessResult::neutral();
+    }
+
+    if (!in_array($operation, ['download', 'view'])) {
+        return AccessResult::neutral();
+    }
+
+    $schemes = Drupal::service('flysystem_factory')->getSchemes();
+    $scheme = StreamWrapperManager::getScheme($entity->getFileUri());
+
+    if (!$scheme || !in_array($scheme, $schemes, TRUE)) {
+        return AccessResult::neutral();
+    }
+
+    $settings = Settings::get('flysystem', []);
+
+    if (empty($settings[$scheme]['config']['public'])) {
+        return AccessResult::neutral();
+    }
+
+    if ($operation === 'download') {
+        return AccessResult::allowed();
+    }
+
+    return AccessResult::allowedIfHasPermission($account, 'access content');
+}