diff --git a/modules/image/image.module b/modules/image/image.module index 0e0e457..9203b2d 100644 --- a/modules/image/image.module +++ b/modules/image/image.module @@ -293,7 +293,7 @@ function image_file_download($uri) { // Check the permissions of the original to grant access to this image. $headers = module_invoke_all('file_download', $original_uri); // Confirm there's at least one module granting access and none denying access. - if (!empty($headers) && !in_array(-1, $headers)) { + if (!in_array(-1, $headers)) { return array( // Send headers describing the image's size, and MIME-type... 'Content-Type' => $info['mime_type'], diff --git a/modules/image/image.test b/modules/image/image.test index 1ca8465..f120156 100644 --- a/modules/image/image.test +++ b/modules/image/image.test @@ -218,6 +218,12 @@ class ImageStylesPathAndUrlTestCase extends DrupalWebTestCase { $this->drupalGet($generate_url); $this->assertResponse(200, t('Image was generated at the URL.')); + // Make sure that access is denied for existing style files if we do not + // have access. + variable_del('image_module_test_file_download'); + $this->drupalGet($generate_url); + $this->assertResponse(403, 'Confirmed that access is denied for the private image style.'); + // Repeat this with a different file that we do not have access to and // make sure that access is denied. $file_noaccess = array_shift($files);