I'm migrating a publications database from an old CMS to drupal 7 using the migrate module. One of the requirements is that some publications (nodes of content type document) will be available to the public (anonymous users and everyone else) and some will be staff only (administrators, staff, and probably some higher level roles created for content editing). Each publication can have an arbitrary number of associated files, each of which can also be publicly available or internal only (Same set of role based control).

How could I set this up? So far my two possible solutions have been:

  1. creating a different content type called files and using inline entity form to to associate thre file nodes with the publications. This will allow me to ad a field for whether the file node is publicly available or not

  2. Using the media module. Unfortunately it appears that the Migrate Extras module that has media support doesn't support Media 7.2.x (As far as I can tell it is designed for 7.1.x). I have tried installing Media 1.x but I have so far been unsuccessful at getting migrate to recognize the extra field as a destination field for migrate to write to.

  • Please split off the Media + Migrate question from this question. And I suppose you can find more about it already elsewhere.
    – dmsmidt
    Jan 19, 2016 at 10:46
  • @dmsmidt I actually have another question about it, but it is getting no answers, I was just mentioning it to explain what I've already tried.
    – UltraBob
    Jan 19, 2016 at 12:29

1 Answer 1


The first thing to understand when you want to shield files from unauthorized access in Drupal is the difference between the Public and Private stream wrapper. By default files are uploaded in Drupal in a public directory and no matter what you do with access control on entities the files will be publicly available directly via the url to the file. So first make sure you setup Drupal to be able to serve files through Drupal via the Private file system (stream wrapper), instead of directly through the web server (public). Take a look at "/admin/config/media/file-system". You can read more about this on Drupal.org.

In any case you will need an extra access control module (and/or custom code). If you don't use Media and only use the Private files stream wrapper you will be able to shield files per role using the Content Access module.

If you want Media not only for access but also for the other nice features it brings think about this: it will not solve your file access issue out of the box. And the Content Access can't help you anymore because it really only works for nodes and not for File entities. Because Media depends on File Entity (separate module since version 2.x) you are no longer required to create node types for documents that need to be fieldable, this is nice. But currently there are no good contributed modules I know of that add granular access control to file entities. So you will need custom code to manage access. I could help you out in this case, but I guess it should be a separate question.


I extracted a custom sample module from a project of mine which adds role based permissions to File Entities (untested), see: https://github.com/dmsmidt/drupal_file_entity_access

  • Thanks for this answer! I am bringing the files in private. Ideally I would like to add them as a file field with unlimited entries allowed as part of my publication content type, but I can't figure out how to add that permission switch to them individually then, it needs to be editable by the content authors. Do you have any thoughts on how this might be possible?
    – UltraBob
    Jan 19, 2016 at 10:49
  • 1
    This would require an extra level of abstraction for you file system. This can be done using Media/File Entity or the Scald module. But as noted above there are no contributed modules that work out of the box to give you so much granular control. And often custom attempts will clash with other modules, so you really have to test it well. I had problems with the Commerce File module before. I have done it before using Media and custom code. Media will give you an "edit" button per file which gives access to the file fields in a modal, this form can be enhanced with permission settings.
    – dmsmidt
    Jan 19, 2016 at 11:08
  • 1
    Let me come back to it later, I may be able to share my custom code with you later today.
    – dmsmidt
    Jan 19, 2016 at 11:29
  • 1
    I think your solution will work, although you get all overhead of the 'node' entity you may not like. I posted a link to code I extracted for you on the original answer if you wish to use Media and File Entity (which are nice).
    – dmsmidt
    Jan 19, 2016 at 14:02
  • 1
    Let us continue this discussion in chat.
    – dmsmidt
    Jan 19, 2016 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.