Issue #2304969 by pwolanin, cilefen, Berdir, Devin Carlson, klausi: Fixed Port private files access bypass from SA-CORE-2014-003.

1 files changed, 16 insertions, 8 deletions

diff --git a/core/modules/file/src/FileAccessControlHandler.php b/core/modules/file/src/FileAccessControlHandler.php
index c6183dae406e..2e336af56015 100644
--- a/core/modules/file/src/FileAccessControlHandler.php
+++ b/core/modules/file/src/FileAccessControlHandler.php
@@ -23,18 +23,26 @@ class FileAccessControlHandler extends EntityAccessControlHandler {
    */
   protected function checkAccess(EntityInterface $entity, $operation, $langcode, AccountInterface $account) {
 
-    if ($operation == 'download') {
-      foreach ($this->getFileReferences($entity) as $field_name => $entity_map) {
-        foreach ($entity_map as $referencing_entity_type => $referencing_entities) {
-          /** @var \Drupal\Core\Entity\EntityInterface $referencing_entity */
-          foreach ($referencing_entities as $referencing_entity) {
-            $entity_and_field_access = $referencing_entity->access('view', $account, TRUE)->andIf($referencing_entity->$field_name->access('view', $account, TRUE));
-            if ($entity_and_field_access->isAllowed()) {
-              return $entity_and_field_access;
+    if ($operation == 'download' || $operation == 'view') {
+      $references = $this->getFileReferences($entity);
+      if ($references) {
+        foreach ($references as $field_name => $entity_map) {
+          foreach ($entity_map as $referencing_entity_type => $referencing_entities) {
+            /** @var \Drupal\Core\Entity\EntityInterface $referencing_entity */
+            foreach ($referencing_entities as $referencing_entity) {
+              $entity_and_field_access = $referencing_entity->access('view', $account, TRUE)->andIf($referencing_entity->$field_name->access('view', $account, TRUE));
+              if ($entity_and_field_access->isAllowed()) {
+                return $entity_and_field_access;
+              }
             }
           }
         }
       }
+      elseif ($entity->getOwnerId() == $account->id()) {
+        // This case handles new nodes, or detached files. The user who uploaded
+        // the file can always access if it's not yet used.
+        return AccessResult::allowed();
+      }
     }
 
     // No opinion.