I have a form setup so that when the user enters the correct serial #, they are redirected to the download page.

I don't want the person accessing the download page directly or sharing with anyone else through the URL, as this will bypass the serial validation.

How can this be done in Drupal?

  • 1
    You'll need to put authorisation on the page - in Drupal this is done with permissions (combined with your custom authentication/authorisation of the serial/token.etc), or if you're serving a file to be downloaded directly, the private file system – Clive Mar 8 '16 at 15:03
  • do you know of any tutorials on the subject ? – Stephen O'Connell Mar 8 '16 at 15:14
  • 1
    For the Drupal side of things the examples module is the best I know of; not exactly a tutorial but it has plenty of code samples around permissions. For the non-Drupal parts (validating token etc), your mileage will vary depending on what you need to do. There are too many ways to solve the general problem you've outlined to give specifics really – Clive Mar 8 '16 at 15:21

Below is a solution that should work for users who are logged in (using Drupal 7, I assume).

Use the Content Access module to limit access to your download page to only those users who have a role like (say) "DownloadAllowed". Since you want to protect that download page, you'll need "some" access module.

And use the Rules module to implement a rule like so:

Step 1: Store your serial number (entered when your form is submitted) in a field which will be used in the next step. Even though you can use any "machine name" for that field, let's assume you call it "field_serialnr"

Step 2: Use a variation of the Rule included in my answer to "How to specify a Rules condition related to select list values?". Here is what you should tune in that rule:

  • Replace the Rules Event to something like "After saving new content (of some type that matches your form)".
  • Replace the "Value C" in the Rules Condition to the value of your serial nr.
  • For debugging reasons, start with a Drupal message to be shown (to ensure your rule works correct if the serial nr is ok, and to also verify it works as you want if the serial nr is wrong or missing). After the message shows up as you want it to show, replace the Rules Action with something like "Assign role to user". The role to assign is ... you probably guessed it ... "DownloadAllowed".

With that, those users who entered your serial nr correctly, will just-in-time get permission to access the download page. Those who didn't will be stopped by the Content Access module ... Which is exactly what you want.

PS: for anonymous users trying to access your download page, you could create another Rule to set a Drupal message indicating that they must be logged in before they can access that download page. For that, just use Rules Event "Drupal is initializing" and a Rules Condition to check if the URL they entered matches the one from your download page.

  • HI I tried to import your rule from that answer you provide —"How to specify a Rules Condition Related to Select list Values?" but I got error — Integrity check for the imported configuration failed. Error message: Data selector <em class="placeholder">node</em> for parameter <em class="placeholder">entity</em> is invalid.. – Stephen O'Connell Mar 9 '16 at 11:41
  • Hey Stephen, can you confirm that BEFORE you tried to import that rule, you did adapt all occurences of "optionlist" to the matching part of your fieldname that I assumed (in my answer here) to be something like "serialnr"? If this is not clear enough to understand: what is the field name of your field (on your form) that contains the serial nr ? – Pierre.Vriens Mar 9 '16 at 11:55
  • I have it set up that $form['values']['serial'] = $field['serialnr']. I'm not sure if this is correct tho – Stephen O'Connell Mar 9 '16 at 12:33
  • sorry I meant $field['serialnr'] = $form['values']['serial']; – Stephen O'Connell Mar 9 '16 at 12:39
  • Well, then I'd suggest to change all occurrences of optionlist to serialnr before using the "import" link. If that still causes a similar error, then try with serial instead. Be ware: there are places in the exported rule with "_", and other places with "-" (specific to that optionlist field), and also the fields I used have a machine name that starts with "field" (not sure about your case). If you still can't get the import to work, you may want to try to use the Rules UI to just manually (quickly) create a similar rule. Let me know if you need help in that case. – Pierre.Vriens Mar 9 '16 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.