Add file access check to IIIF manifest generation. (Islandora#884)

rosiel · Dec 14, 2022 · e556cbc · e556cbc
1 parent c93930a
commit e556cbc
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/modules/islandora_iiif/src/Plugin/views/style/IIIFManifest.php b/modules/islandora_iiif/src/Plugin/views/style/IIIFManifest.php
@@ -198,6 +198,10 @@ protected function getTileSourceFromRow(ResultRow $row, $iiif_address, $iiif_bas
         /** @var \Drupal\Core\Field\FieldItemListInterface $images */
         $images = $entity->{$viewsField->definition['field_name']};
         foreach ($images as $image) {
+          if (!$image->entity->access('view')) {
+            // If the user does not have permission to view the file, skip it.
+            continue;
+          }
           // Create the IIIF URL for this file
           // Visiting $iiif_url will resolve to the info.json for the image.
           $file_url = $image->entity->createFileUrl(FALSE);