0

I'm trying to set up private files on Drupal 7 using Organic Groups. So far, I have

(1) one group type that although I appear to have set it up as such

enter image description here

(2) have private files set up in as below. (The webroot is /var/www/html.)

enter image description here

(3) Ensured the link on the OG's page is /system/files/test.example.doc,

enter image description here

(4) I inspected the database entry and this appears to be good. 

MariaDB [s7data]> select * from file_managed \G

*************************** XXX. row ***************************
      fid: 357
      uid: 103
 filename: test.pwww_.doc
      uri: private://test.pwww_.doc
 filemime: application/msword
 filesize: 9
   status: 1
timestamp: 1460390385
     uuid: 3a9877fc-77b2-47bc-8d4f-e8bc349f4c74

I am still able, using this link path do download that doc in a new browser without being logged in. In effect, this file is not private and does not require an authenticated session to download.

Question: Did I miss something? How does one set up private files correctly on Drupal 7?

|improve this question|||||
  • Your tmp directory should not be inside your private files. – Neograph734 Apr 11 '16 at 18:14
0

Whenever possible it's recommended that you choose a directory located outside of your Drupal root folder (or actually outside your web root), which may be tricky if you are on a shared host. If you do have access though, you can choose a private directory which will be on the same level as your web root directory (often called public_html or www or similar).

From Working with files in Drupal 7 and Drupal 8.

The best practice is to place your private files outside of your webroot, so they should not be inside /var/www as that would make them accessible over the web. Place them in /var/somefolder instead, make sure your webserver has read write access to that folder. After that you should only be able to access them via /system/files/test.example.doc and it should not work for anonymous users.

UPDATE:

Above is based on the assumption you were accessing the file via example.com/drupal-private-file-system/test.example.doc. this can be prevented by using the linked best practise guide.

If an anonymous user can access your files with on url like example.com/system/files/test.example.doc you have a problem with your permissions and anonymous users are given the permission to download private files.

|improve this answer|||||
  • Which permission is associated with private files? That is something else that I looked for. – Rick Apr 11 '16 at 18:28
  • Depends, are you using File Entity? – Neograph734 Apr 11 '16 at 18:30
  • Oh, apparently there is no such permission in vanilla Drupal... :s. That is strange because access should have been restricted then. – Neograph734 Apr 11 '16 at 18:32
  • Is the file attached to a publicly visible entity? For instance if you attach a private file to a node and the anonymous user has View published content permissions (which is default) I believe the file also showed up. You might need to make sure the parent entity where the file is attached to is blocked to anonymous users by permissions. See: drupal.org/documentation/modules/… – Neograph734 Apr 11 '16 at 18:38
  • The idea is that files aren't private until you explicitly make them private - it's a bit counter-intuitive to start with. See hook_file_download for more details – Clive♦ Apr 11 '16 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.