2

I have a drupal 7 site with an academic paper that should be accessible only to authenticated users. At the moment the paper is set up as a hyperlink in the full text field of a biblio page and only authenticated users can reach the page.

However, if non-authenticated users get their hands on the url that leads to the pdf version of the paper, they can download it. How can i redirect non-authenticated users that use the url to an error page?

Improve this question
1

2 Answers 2

Reset to default
2

To control which user can access a download link, you need what is called a "private file system" in Drupal. Public files are directly served to the visitor by the web server; Drupal doesn't even come into play. Private files on the other hand are served by Drupal, so it can check permissions before sending the file.

You do not need additional modules to enable the private file system and upload files to it. The documentation should get you started. If you want to make it easy to create links in the body text to file download URL's, you could try adding the CKeditor and Linkit modules.

Improve this answer
0

Maybe Private files download permission handle what you want.

Some quote form this module page :

Version 1.x provided "two useful features which Drupal itself is missing: a simple permission to allow downloading of private files by role, plus the ability to combine both public and private downloads".

Version 2.x removes the "global" permission and implements a per-directory by-user and by-role filter instead, to let the administrator better tweak the whole website and increment the overall security.

Also you can use Field Permissions module

some quote form this module page :

The Field Permissions module allows site administrators to set field-level permissions to edit, view and create fields on any entity.

Features

Enable field permissions on any entity, not just nodes.
Role-based field permissions allowing different viewing patterned based on what access the user has.
Author-level permissions allow viewing and editing of fields based on who the entity owner is.
Permissions for each field are not enabled by default. Instead, administrators can enable these permissions explicitly for the fields

where this feature is needed.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.