Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
The Media Browser widget will always permit any supported URI scheme, ignoring the options set for the content type.
Comment | File | Size | Author |
---|---|---|---|
#7 | media-remove-disallowed-schemes-1289680-07.patch | 1.52 KB | Devin Carlson |
#3 | media_field_option_schemes.png | 35.79 KB | smartinm |
Comments
Comment #1
arthurf CreditAttribution: arthurf commentedInvestigating
Comment #2
arthurf CreditAttribution: arthurf commentedThere is an overlap with #1201924 Marking this a a duplicate and closing.
Comment #3
smartinm CreditAttribution: smartinm commentedI think this issues is not related to #1201924: Widget does not respect settings in file_field_instance_settings_form (uri scheme, directory, extensions, file size).
The media field setting "Allowed URI schemes" (allowed_schemes) is totally ignored. I think it's never been implemented.
The patch in comment #30 from related issue:
But the
schemes
global option is never used in the code.Comment #4
xcafebabe CreditAttribution: xcafebabe commentedI'm facing the same issue described by @smartinm in #3.
If you select only the private uri scheme, images uploaded by media browser are always stored in the public folder. This happens with Media version 7.x-2.0-unstable6+70-dev
This issue is related with #1201924: Widget does not respect settings in file_field_instance_settings_form (uri scheme, directory, extensions, file size) but the patch proposed in comment #30 on that issue does not match with the current code in branch 7-x-2.x
Comment #5
TechNikh CreditAttribution: TechNikh commentedsame issue here. though the file field is configured to be private, the uri scheme in the database shows public://
Comment #6
Devin Carlson CreditAttribution: Devin Carlson commentedMarked #1994278: Take into account the allowed_types and allowed_schemes of the media module field widget as a duplicate.
Comment #7
Devin Carlson CreditAttribution: Devin Carlson commentedA patch to ensure that the upload destination scheme is one of the allowed schemes.
For the related File entity issue, see #2217841: Scheme selection form provides options not allowed by the field settings.
Comment #8
Dave ReidCommitted #7 to 7.x-2.x.