I am developing a custom entity, which has a file field, which accepts .zip files. After the entity save, the contents of the zip file are decompressed into a folder specific to the .zip file, in the public files directory.

I'm am wondering if it is possible to create "private directories", which would act similar to standard Drupal private files...basically I want to restrict access to any file in the directory, but Drupal not knowing what files may be in the directory.

Basically the zip file will contain several .html files, javascript, and css files, which will be launched on the entity view page in an iframe.

Is this even possible?

Would anyone have some possible strategies to accomplish this goal?

I'm not asking how to setup a private file directory for storing and controlling access to single files, as is standard Drupal, I'm asking if it is possible to control access to any random file in a certain directory....inside the public files area.

I'm wanting to manage unmanaged files, by managing the parent directory, not the individual files

I'm open to using the Drupal core private file system, as long as Drupal doesn't have to manage the individual files specifically


1 Answer 1


Using just Drupal, it's not possible.

It's important to consider what setting store files as public means for Drupal. Essentially, it means Drupal relies on the web server for output of files URLs (vs. it being the gatekeeper to a directory non-accessible from the web server).

As such, to do what you want would require your zip processing code to do extra work of configuring your web server to restrict access (e.g. creating .htaccess files). You would also need some custom code to create proxy URLs paths to any file inside the unpacked zip directory. Lastly, you'd want to take a hard look at possible security vulnerabilities you're opening up by giving users unfettered access to run/view any arbitrary JS/HTML/CSS on your domain.

  • Actually, using just Drupal, it is possible. It only took me 4 hours to figure it out....answer forthcoming...but I'm interested if the community can come up with an answer too Commented Dec 3, 2015 at 18:55
  • Ok, its impossible to make private directories, within public files directory, AFAIK, but it is possible to use the private files system to create "managed directories" where any unmanaged file in the directory can be made conditionally accessible, based solely on the directory it is in Commented Dec 3, 2015 at 19:08
  • I'd still be interested to understand any Drupal + whatever approaches to the original question, "create private directories, in the public file system?" Commented Dec 3, 2015 at 19:22
  • @jackrabbithanna One of the standard Drupal configurations is to have /sites/default/files/private as the private:// directory. You could probably create separate private file streams for each folder with special access control (making sure the OS permissions to the folders are correct). Also, your question doesn't actually make sense, because if the directory is private, it's not a public file system.
    – mbomb007
    Commented Nov 12, 2020 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.