How to skip the ReferenceAccess constraint on a file upload by an anonymous user? I have a contact form for job applications with a file field on it so users can upload their CV. Because of privacy / security, the uploaded CV's must be stored in the private filesystem.

Unfortunately, a problem occurs when an anonymous user tries to add a CV and submit the form. Since the anonymous user does not have access to the uploaded file, the file field's ReferenceAccess constraint (\Drupal\Core\Entity\Plugin\Validation\Constraint\ReferenceAccessConstraint) kicks in and throws a validation error: You do not have access to the referenced entity (file: 1). As a consequence, the user is not allowed to submit the form.

Is there a way to tell Drupal to skip the ReferenceAccess constraint when anonymous users reference a file that they just uploaded themselves?

Update: I came to realize that this does not happen when using the core  file field, only with the File Entity module.
That constraint is validated by \Drupal\Core\Entity\Plugin\Validation\Constraint\ReferenceAccessConstraintValidator. ReferenceAccessConstraintValidator::validate uses the following code.

  /* @var \Drupal\Core\Entity\FieldableEntityInterface $referenced_entity */
  $referenced_entity = $value-&gt;entity;
  if ($referenced_entity) {
    $entity = $value-&gt;getEntity();
    $check_permission = TRUE;
    if (!$entity-&gt;isNew()) {
      $existing_entity = \Drupal::entityManager()-&gt;getStorage($entity-&gt;getEntityTypeId())-&gt;loadUnchanged($entity-&gt;id());
      $referenced_entities = $existing_entity-&gt;{$value-&gt;getFieldDefinition()-&gt;getName()}-&gt;referencedEntities();

      // Check permission if we are not already referencing the entity.
      foreach ($referenced_entities as $ref) {
        if (isset($referenced_entities[$ref-&gt;id()])) {
          $check_permission = FALSE;
          break;
        }
      }
    }

    // We check that the current user had access to view any newly added
    // referenced entity.
    if ($check_permission &amp;&amp; !$referenced_entity-&gt;access('view')) {
      $type = $value-&gt;getFieldDefinition()-&gt;getSetting('target_type');
      $this-&gt;context-&gt;addViolation($constraint-&gt;message, [
        '%type' =&gt; $type,
        '%id' =&gt; $id,
      ]);
    }
  }


(In particular, see the line containing $referenced_entity-&gt;access('view').)

We can hook into the file's access control to alter the outcome, with hook_entity_access() or hook_ENTITY_TYPE_access().

Another solution could be to create a new field type which inherits everything from Drupal\file\Plugin\Field\FieldType\FileItem, except for the ReferenceAccess constraint in its plugin definition. You can do this in two ways:


Create a new plugin class that extends the original class, and copy and modify its docblock, including the @FieldType annotation.
Implement hook_field_info_alter(), copy the file plugin definition to your own, and make the necessary adjustments there.