Issue #3594963: Let owners view a vault file from the Files list and the Edit form

Frank Mablyrequested to merge
issue/pdv-3594963:3594963-let-owners-view into 1.x

Lets an owner view a vault file (currently they can only Edit or Delete it; only records have a View).

Resolution

  • New owner-only route pdv.item.download (/vault/item/{pdv_item}/download): decrypts and serves the bytes with the stored MIME. Inline for a safe allowlist (images, PDF, plain text); attachment otherwise, so an uploaded HTML/SVG cannot run script in the owner session. X-Content-Type-Options: nosniff and no-store.
  • A View action on the Files list, and the Edit-form filename links to the same route (new tab).

Tests

VaultDownloadTest: owner views a safe type inline (bytes/MIME/filename/nosniff), a risky type is sent as attachment, a non-owner is denied. phpcs + phpstan clean; documentsTable-rendering suites still pass.

Dependency

Graceful locked-vault behavior rides on the locked-vault redirect subscriber in #3594933 (the View link redirects to unlock and returns afterward); merge that first if not already.

Merge request reports