0

I have a few image styles that I only want certain node types to be able to view because certain images on my site have an open license for use and so I have a style for a large image gallery view, while others do not and so they shouldn't use this style.

The images, and the image styles are stored in private locations and served through Drupal.

Is there a way I can set conditions on when an image style can be downloaded for an image; for example by node type, a field flag, or who a user is logged in as?

Is there another solution to this issue?

| improve this question | |
3

This is not really possible. The module the create this doesn't care or know where the image comes from, so you can't make any permission checks like that. It would be possible to display such images through custom theming Views and many other ways which makes a 100% failsafe permission check more or less impossible.

You can make sure nothing like this will happen based on how you setup your site, and you could add some extra security by overwriting the settings/rendering for image fields, but it won't be 100% fail safe.

| improve this answer | |
  • I'm not convinced this is the answer; if image styles are completely permission agnostic it seems flawed to me that the module would allow private storage of the generated/cached versions of those images. – Jane Panda Nov 7 '11 at 14:38
  • @Bob It's doesn't add or remove permission, and why should it, it only creates a presentation. You have the file system to handle access of files and the field system for handling access of image field. – googletorp♦ Nov 7 '11 at 15:05
  • Is there a way to manage downloading the generated images then? It's not file space I'm concerned about. – Jane Panda Nov 7 '11 at 15:16
  • @Bob He's talking about the actual permissions on the directories on the hard drive where the images are stored. Those permissions are set by the sysadmin of the server. There's no real clear way to relate permissions on certain folders on the hard drive to drupal permissions and roles. – LSU_JBob Nov 15 '11 at 17:04
  • I'm talking about private file downloads that are handled through Drupal though; files located in locations that are not publicly available but served through Drupal. – Jane Panda Nov 15 '11 at 21:15
1

There is no access handling on image styles, only on images/files.

The only way to do this would be to completely override the page callback the menu entries in image_menu() for the public and/or private file system, then copy the image_style_deliver() function and change it.

| improve this answer | |
1
+100

The problem, I think, is that you are trying to do this through a single field. Create two image fields (e.g. Public image and Private image or whatever you want). Set whatever image styles you want on them. Then use the Field Permissions module to protect the private field to only display when a user with the right privileges is logged in (you could also hide from displaying the public one, so they don't get confused as to which one). Then, as long as your image styles folder is in the Drupal's private folder they should be protected from anyone wanting to access the image styles directly.

| improve this answer | |
1

You can use the Image Style Access module to control access to images by style and file location.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.