All the images used on my site (e.g. user profile pictures, photos used in a slideshow, images inserted in content types, an image gallery, etcetera) are not shown anymore after logging in using a role other than that of administrator.

I am sure the problem is related to permissions (in fact, the error log shows Access Denied errors) however, after a lot of searching on the internet, testing (including disabling a number of modules), I still can not find the root cause and need help.

Some relevant information:

  • Site originally developed on a Synology NAS (Linux) (using Omega 4 theme).
  • Site exported to Acquia Dev Desktop (v. 7.26.29) on a Windows PC.
  • The version on Acquia Dev Desktop is used as developing environment.
  • Site on NAS server used as test environment.
  • Drupal version: 7.28
  • Site is developed with a section for members only.
  • Default download method: 'Private local files served by Drupal'.
  • The public file system path: sites/default/files.
  • The private file system path: sites/default/files/private.
  • All the images, except for the site logo, are stored within the private file system.
  • Using the "Content Access" module for setting permissions.

The moment I log out from a user account with administrator role, all the images (except logo) disappear. This happens on both sites (which is to be expected). The error log clearly shows Access Denied errors for non-administrators, so there is a permissions issue.

What have I tried so far?

  1. Play with file permissions: I have read dozens of posts on checking & changing file permissions in the files folder & the files/private folder (and sub folders). On Windows handling permissions is less straightforward than on the Linux NAS. However, on the NAS I have even changed the permissions on the private file folder and files to 777, and still the images are not shown for non-administrators.
  2. Disable modules related to permissions: I have disabled modules that enforce access/visibility restrictions (like "Content Access", or visibility settings in "Panels"). But disabling these restrictions did not have any effect on the issue.
  3. Change default download method & store files in public file system: new images stored are saved in public file structure and are shown also for non administrator roles. But I do not want the files to be open to the public.
  4. Looked at impact of Drupal update since version 7.20: Some people suggested changing the setting "$conf['image_allow_insecure_derivatives'] = TRUE;" in the settings.php file. Did not test this, as this negates the security issue, so not an acceptable method.

Right now I do not know where to look & test any further, I spend almost a week finding out myself. Can anyone give me any pointers based on the above?

There is one element that I do need to mention, although I am not 100% sure it is (directly) related: All the images I use are making use of image styles. Even as the Administrator, the modified sample file in the Image Style editor (dummy image on the right) is not shown. The link to that sample file goes all the way into the private file system (when download method is private). However, the dummy image is not shown and when I click on its place holder, I get an "Access denied" error (as Administrator!). Changing the default download method to "Public" resolves this particular problem, the dummy image is shown now. The reason that I am not sure if this is in any way related, is the fact that I also added two image fields to an existing content type. Both without an image style, with one using the public file system, the other using the private file system. Upon logging in as a non-administrator, only the public file was shown. As the element of image styles was not part of the test, I assume that the image styles are not directly influencing here.

As said already, I could use some expert help to show me the right direction, as I am not seeing it anymore I am afraid.....

  • 2
    Sorry for the possibly obvious question, but when you said you do not want the files to be open to the public, are you including the image files in that? If you really do intend for the images to be private, then it's working as expected. Only logged-in users with access to the host entity can access the image file. – Les Lim Jul 2 '14 at 21:48
  • Yes, that includes the images (that are part of the web site that is restricted to anonymous viewers). I want only the users that are registered to be able to see and possibly download images (e.g. the gallery). The users are linked to user roles and with these roles the entities can be viewed without any problems, but the images disappear. – Ben Jul 3 '14 at 19:47
  • hook_file_download_access will allow you to control files thare are downloaded. Simply deny anyone that is not an authenticated user and allow anyone else. – chadpeppers Jul 28 '14 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.