Commit 58ce0c5f authored by Janna Malikova's avatar Janna Malikova
Browse files

Implemented permission check when creating media

parent d0d0b1a0

modules/dropzonejs/media_bulk_upload_dropzonejs.info.yml

+2 −2
Changes for modules/dropzonejs/media_bulk_upload_dropzonejs.info.yml: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -4,5 +4,5 @@ description: Allows DropzoneJS integration with media bulk upload. 
core_version_requirement: ^10.3 || ^11

package: Media

dependencies:

  - media_bulk_upload

  - dropzonejs
 
  - media_bulk_upload:media_bulk_upload

  - dropzonejs:dropzonejs

src/Controller/MediaBulkUploadController.php

+16 −1
Changes for src/Controller/MediaBulkUploadController.php: 16 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -151,7 +151,22 @@ class MediaBulkUploadController extends ControllerBase { 
  public function accessForm(AccountInterface $account, MediaBulkConfigInterface $media_bulk_config) {

    $mediaBulkConfigId = $media_bulk_config->id();



    if (!$account->hasPermission("use $mediaBulkConfigId bulk upload form")) {

    // Check if the user has permission to create media of any of

    // the media types defined in the media bulk config.

    $can_create_media = FALSE;

    $access_handler = $this->entityTypeManager->getAccessControlHandler('media');

    foreach ($media_bulk_config->get('media_types') as $media_type_id) {

      if ($media_type_id == 0) {

        continue;

      }



      if ($access_handler->createAccess($media_type_id, $account)) {

        $can_create_media = TRUE;

        break;

      }

    }



    if (!$can_create_media || !$account->hasPermission("use $mediaBulkConfigId bulk upload form")) {

      return AccessResult::forbidden('Media Bulk Upload form is not accessible for the user.');

    }

src/Form/MediaBulkConfigForm.php

+4 −4
Changes for src/Form/MediaBulkConfigForm.php: 4 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -183,19 +183,19 @@ class MediaBulkConfigForm extends EntityForm implements ContainerInjectionInterf 
      $scheme = $this->streamWrapperManager::getScheme($upload_location) ?? NULL;



      if (empty($upload_location)) {

        $upload_location_error = t('No upload location provided.');

        $upload_location_error = $this->t('No upload location provided.');

      }

      elseif ($scheme && str_starts_with($upload_location, 'private://') && !PrivateStream::basePath()) {

        $upload_location_error = t('You need to configure and set up your private files directory before you can use it for Media Bulk Uploads.');

        $upload_location_error = $this->t('You need to configure and set up your private files directory before you can use it for Media Bulk Uploads.');

      }

      elseif ($scheme && str_starts_with($upload_location, 'temporary://')) {

        if (!$this->fileSystem->getTempDirectory()) {

          $upload_location_error = t('You need to configure and set up your temporary files directory before you can use it for Media Bulk Uploads.');

          $upload_location_error = $this->t('You need to configure and set up your temporary files directory before you can use it for Media Bulk Uploads.');

        }

      }

      elseif (!$scheme ||

        !$this->streamWrapperManager->isValidScheme($scheme)) {

        $upload_location_error = t('Invalid scheme provided. Standard schemes include public://, private:// or temporary://');

        $upload_location_error = $this->t('Invalid scheme provided. Standard schemes include public://, private:// or temporary://');

      }



      // Create the directory and give it the permissions needed.

src/Form/MediaBulkUploadForm.php

+25 −0
Changes for src/Form/MediaBulkUploadForm.php: 25 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -121,6 +121,13 @@ class MediaBulkUploadForm extends FormBase { 
   */

  protected $fileSystem;



  /**

   * The access control handler for media entities.

   *

   * @var \Drupal\Core\Access\AccessControlHandlerInterface

   */

  protected $accessControlHandler;



  /**

   * Constructs a new BulkMediaUploadForm.

   *
@@ -170,6 +177,7 @@ class MediaBulkUploadForm extends FormBase { 
    $this->loggerFactory = $loggerFactory;

    $this->moduleHandler = $moduleHandler;

    $this->fileSystem = $fileSystem;

    $this->accessControlHandler = $entityTypeManager->getAccessControlHandler('media');

  }



  /**
@@ -229,6 +237,10 @@ class MediaBulkUploadForm extends FormBase { 
    $mediaTypeLabels = [];



    foreach ($mediaTypes as $mediaType) {

      // Check if current user has permission to create media of this type.

      if (!$this->accessControlHandler->createAccess($mediaType->id(), $this->currentUser)) {

        continue;

      }

      $extensions = $mediaTypeManager->getMediaTypeExtensions($mediaType);

      natsort($extensions);

      $this->addAllowedExtensions($extensions);
@@ -538,6 +550,19 @@ class MediaBulkUploadForm extends FormBase { 
    $mediaTypes = array_intersect_key($matchingMediaTypes, $allowedMediaTypes);

    $mediaType = reset($mediaTypes);



    // Check if user has permission to create media of this type.

    $can_create = $this->accessControlHandler->createAccess($mediaType->id(), $this->currentUser);

    if (!$can_create) {

      $this->messenger()->addError(

        $this->t('You do not have permission to create media of type @media_type for file @filename.',

        [

          '@media_type' => $mediaType->label(),

          '@filename' => $filename,

        ])

      );

      throw new \Exception("You do not have permission to create media of type " . $mediaType->label() . " for file $filename.");

    }



    if (!$this->validateFileSize($mediaType, $file)) {

      $fileSizeSetting = $this->mediaSubFormManager->getMediaTypeManager()

        ->getTargetFieldMaxSize($mediaType);