Issue #27: Check Collabora access in the field formatter.

CollaboraOnline · Oct 24, 2024 · 1b5536a · 1b5536a
1 parent c5362c3
commit 1b5536a
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/src/Plugin/Field/FieldFormatter/CoolPreview.php b/src/Plugin/Field/FieldFormatter/CoolPreview.php
@@ -12,6 +12,7 @@
 namespace Drupal\collabora_online\Plugin\Field\FieldFormatter;
 
 use Drupal\collabora_online\Cool\CoolUtils;
+use Drupal\Core\Cache\CacheableMetadata;
 use Drupal\Core\Field\FieldItemListInterface;
 use Drupal\Core\Field\Plugin\Field\FieldFormatter\EntityReferenceFormatterBase;
 use Drupal\media\MediaInterface;
@@ -49,6 +50,15 @@ public function viewElements(FieldItemListInterface $items, $langcode) {
             return [];
         }
 
+        $access_result = $media->access('preview in collabora', NULL, TRUE);
+        (new CacheableMetadata())
+            ->addCacheableDependency($access_result)
+            ->applyTo($elements);
+
+        if (!$access_result->isAllowed()) {
+            return $elements;
+        }
+
         foreach ($this->getEntitiesToView($items, $langcode) as $delta => $file) {
             $url = CoolUtils::getEditorUrl($media, false);