0

The normal behavior, described also in Give access to private files to certain role? seem to be the following.

Once configured, files stored in the private directory are inaccessible via a direct link; however, if Drupal constructs a link to the file, the file will be accessible to anyone who can see the link.

Does it work for media type fields? How can it be configured?

I would like the files to be accessible only from users who authenticate themselves using CAS.

Improve this question

4 Answers 4

Reset to default
2

It is possible to use private files by default with Media.

You just need to click the Field settings tab for the field you want to store files in your private folder

Use private folder for Drupal Media field

Improve this answer
1

You can use the private file system with media entities. Users who have permission to view the entity they are attached to will be able to access the files. So if your file is attached to a media entity that is attached to a publicly visible node, the node is public, so the file will be open to anyone. If you add some sort of viewing permissions to the node through a contributed module or something, then the files will only be visible to those users. It is however possible to do custom permissions, using hook_file_download().

Improve this answer
2
  • how can i configure the private file system with media entities?
    – Matoeil
    Commented May 17, 2019 at 13:08
  • 2
    Sorry, it looks like I spoke wrong. I've just done some testing, and it doesn't look like private files with media is possible by default. This module attempts to solve the issue: drupal.org/project/media_private_access but it's not yet ready.
    – Jaypan
    Commented May 17, 2019 at 22:54
0

We have ended up using the protected file module.

File medias chosen to be protected are only accessible to authentified users.

[https://www.drupal.org/project/protected_file][1]
Improve this answer
1
  • A file field is not a media entity. Basic file fields might meet your use case, but don't expect these items to show in the media library, allow fielding, enable view modes, etc. The big thing is, do you intend on reusing the files? If yes, you should reconsider.
    – Ryan Hartman
    Commented Dec 18, 2020 at 5:38
0

Currently the only true solution to this is to set permissions by roles on the media entities themselves. I was able to achieve this by using the Permissions by Term module and it's sub-module "Permissions by Entity". Add a Taxonomy field to your media types and configure as appropriate.

Note that that this utilizes content_access and may require rebuilding permissions. In my experience, if using this at any kind of scale you should also setup Node Access Rebuild Progressive.

Source

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.