There is an option in Configuration > File system which let you define a path for private files. After setting a path in this field, the access for all users is restricted (including admin). I need to give the permission of accessing this directory and its files to some users. How?


Your module has to implement hook_file_download(). By default all private files will give access denied.

If your access rules are not complex, you can also use one of contrib modules, ex. Private files download permission

  • 1
    I'm using this module and it always shows a forbidden message! – shekoufeh Feb 24 '15 at 9:20
  • 1
    You have to go to admin/config/media/private-files-download-permission page and create permission rules there ("Add new directory" option). You can specify if files in directory should be available for user (or role). – zaporylie Feb 24 '15 at 9:40
  • 1
    Just be sure that you are not using too many permission modules for private files. – zaporylie Feb 24 '15 at 9:43
  • 1
    I've done that before. Isn't there any issue about bypassing permissions in permission page? – shekoufeh Feb 24 '15 at 11:51

The difference between the Drupal public and private file systems is whether the web server or Drupal handles accessing the files.

  • With the public file system, Drupal doesn't do anything for accessing the files. The assumption is that the web server can access these files and they are within the web root of the site. Drupal just generates URLs that allow the web server to serve those files.
  • With the private files system, things are different. They are served by Drupal, and Drupal gets to decide if the user has access to those files. In core, this happens when the file is attached to content the user has access to, if I'm not mistaken, but there are other ways to tell Drupal a user should get access to a file. Since Drupal should have full control over file access (through URL paths it serves), this means that the private file system should be in a directory outside the web root, as those files are not intended for direct access by the web server (theoretically you could also have the files within the web root and use some other means to restrict access through the web server, like .htaccess, but that's a more fragile solution).

Both directories should be readable and writable by Drupal (whatever user Drupal runs as, which would typically be something like apache, httpd or php, depending on your setup). The public file system should be within the web root, the private file system should really be outside it, if you ask me, but at the very least have some other way configured to not be accessible through the web server from the outside.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.