Steps to reproduce

Starting with a fresh "Standard" install;

  1. admin/config/media/file-system: Configure a "Private file system path".
  2. admin/config/media/file-system: Make "Private local files served by Drupal." the "Default download method".
    • This is necessary so that styled (aka "imagecached") images are stored in and served from the private files directory.
    • This option only becomes available after configuring the "Private file system path" in step 1.
  3. admin/structure/taxonomy/tags/fields: Add the existing field "Image: field_image (Image)".
  4. admin/structure/taxonomy/tags/add: Add a term with an image.
  5. admin/structure/taxonomy/tags: Click the name of the term created in the previous step to view it.
    • Expected behaviour: The image is displayed.
    • Actual behaviour: The image is not displayed.

#1414990: Orphaned private files can not be accessed is related. However the bug described in this issue occurs with or without the patch from #1414990 applied.

This is also a bug in Drupal 7.

One workaround is to reference the same file (E.g. using Media module's media library picker) from a an entity which implements hook_file_download_access() or hook_file_download_access_alter(). The core modules/entity-types which implement this are comment, node & user. I do not believe this works in Drupal 8 because I think Media module is the only way to reference the same file from multiple different entities.

Comments

jmking’s picture

Just ran into this bug in Drupal 7. It's an interesting one.

If you look at how node_file_download_access does it, it just checks if the entity type is a node and then falls through to node_access(). Since there's no such thing as a taxonomy_access function, there should probably be a default implementation added to the taxonomy module:

function taxonomy_file_download_access($field, $entity_type, $entity) {
    if ($entity_type == 'taxonomy_term') {
        return true;
    }
}

In the meantime, those with Drupal 7 or 8 who are running into this issue can simply create their own module with that simple function added to it (with their module name used instead of taxonomy in the function name).

That's a much simpler workaround than attaching the file to a node.

PawelR’s picture

Status: Needs work » Closed (cannot reproduce)

I tested and couldn't reproduce in Drupal 8. Image has been displayed properly served as private file.

jody lynn’s picture

Version: 8.x-dev » 7.x-dev
Status: Closed (cannot reproduce) » Needs work

If it can't be reproduced in D8 it's still a valid bug in D7.

It looks like comment, node, and user entities implement hook_file_download_access but the implementation for taxonomy term was forgotten.

The function from #1 looks like the appropriate fix. Needs to be rolled as a patch.

berdir’s picture

Status: Needs work » Closed (duplicate)

No, it's not fixed in 8.x, but it's a duplicate of #1327224: Access denied to taxonomy term image.