Recently, I came across an issue where private files in media entities, that were embedded in a paragraph, were accessible by anonymous users. While a user could not get access to the page, access was allowed via direct URL to the file.
This post is part of our Drupal 9 upgrade series. If you're on Drupal 8 already, there's lots of useful advice below; we'll also have a post just for you soon.
Recently, I came across an issue where private files in media entities, that were embedded in a paragraph, were accessible by anonymous users. While a user could not get access to the page, access was allowed via direct URL to the file.
This post is part of our Drupal 9 upgrade series. If you're on Drupal 8 already, there's lots of useful advice below; we'll also have a post just for you soon.