2

I have a node with a File field and i am using public file system. I have uploaded a file via File field and checked the mark "display" in the list of attached files to node, but still, anonymous user's can't even view it (also they can't download it), till i check this permission:

enter image description here

But i think it's security vulnerability. Is drupal 7 file access system broken? Or am i missing something?

Manage display page

enter image description here

  • You should not give anonymouos to bypass file access control. Could you post a screenshot of the "manage display" page for the content type? – arrubiu Feb 19 '14 at 14:40
  • Yeah, sure check the updated post. – Alexander Kim Feb 19 '14 at 15:25
  • Permissions on sites/default/files are ok? Link to download file appear on node view? – arrubiu Feb 19 '14 at 15:28
  • Permission on folder files is 775, no, link doesn't appear. When i try to open the file directly it throws me - access denied. – Alexander Kim Feb 19 '14 at 15:38
  • And if you view the node using admin? Are you sure that the file is a "public" and not "private" file? – arrubiu Feb 19 '14 at 15:39
3

Figured out! I have uploaded a .rar file, so drupal wouldn't recognize this as existed file types e.g. audio, image, document. I had to go in admin/structure/file-types/manage/document

And add mimetypes for .rar and .zip extension:

application/rar
application/zip

Then just reuploaded file and gave anonymous user's permission:

Document: Download any files 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.