I wrote a custom module, which logs errors to an external text file. The files are kept in


The problem is, if the user know the name of the file, they can go directly to it. For example, if they go to:


The will get a forbidden error. But, if they know the name of the document and go to:


the full file is rendered to the browser. Is there a way to prevent this? Ideally, I would like to show the files to certain users but at the very least prevent it all together.

1 Answer 1


The real problem here is that the files shouldn't be written into the module directory. There are actually two reasons for this (one of which you've run into):

  1. it becomes harder to upgrade the module codebase (i.e. because you have to worry about accidentally overwriting the log files)
  2. anybody can access the files (i.e. this question!)

You mention that you'd like certain users to be able to access the log files. You have a few options:

  1. Move the logfile directory outside of the webroot

    In other words, if your Drupal site resides at e.g. /home/foo/public_html, create a new directory at /home/foo/module_logs and write the files there instead.

    This prevents Apache (or whatever webserver) from delivering the file, but lets it remain accessible to PHP which access it directly from the file system.

  2. Deny access to the files in their current location

    Assuming you're using Apache, you can use a .htaccess file in the directory where the files are written to deny access to them. Some variant on this should work:

    <FilesMatch "\.txt$">
    Deny from all

    As in #1, your module will still be able to read the files (this is what also happens in Drupal's default .htaccess file--you can see that it denies access to e.g. .info files, but Drupal can obviously still read them...)

  3. Turn on private file downloads

    I don't really suggest this to solve your problem, as it's kind of the 'nuclear option' and would affect every file controlled by Drupal. You can find this under the file system settings in the administration area.

    In options 1 and 2, you will have to alter your module. In this one you probably wouldn't need to, but you might need to modify everything else in your site :-)

  4. Use file system permissions

    Again assuming this is running on an Apache webserver, you could also have your module set the o ('other users') bit of the log files' permissions to zero using PHP's chmod() function.

    In other words, your files are probably being created with permissions 644, so you might try creating them with permissions set to 640 instead. Your PHP scripts (i.e. Drupal) should be unaffected unless you change the first or second digit.

    In addition to being Apache-specific, this item also might work differently than expected if your Apache-PHP setup is different than I'm expecting.

  • Thanks. This is helpful. For a quick fix, I added an .htaccess file with just "deny from all". But I think your suggestion for moving the folder is the best option. Thanks again
    – jason
    Dec 18, 2014 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.