Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 300566

Administrator can not delete file entities

$
0
0

Problem/Motivation

Admin users can not delete files in the CMS in any way from UI.

There is a hard-coded condition in Drupal\file\FileAccessControlHandler that only the user that uploaded the file can delete it. For then on, this file is permanently present on the system with no way to delete it from the UI for administrator users. Even when they've asserted the file is not in use anywhere or they are OK to risk data corruption by deleting it.

This can lead to resource exhaustion and unhappy clients that see content in the CMS that can not be deleted by them.

Possible workaround:
Decorate the file access check service and change delete action from custom code.
Have the new custom permission implemented so such users can do so.

Proposed resolution

Have a global level permission that can overstep this check.

Remaining tasks

Discussion - why it's implemented so? :(
Patch.

User interface changes

None expected.

API changes

New permission.

Data model changes

None expected.

Release notes snippet

New permission.


Viewing all articles
Browse latest Browse all 300566

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>