3

This is almost certainly a really stupid question, but the Drupal 7 site we're building has an image gallery that users can upload content to. Unauthenticated users should not be able to see these images, but some other rôles should be able to see all the images uploaded by other users. The way we first built it, images all show up from a directory below the webroot, so anyone can see the image, if they know the URL.

I thought Private files would be my solution, so I followed the instructions there, setting up a folder in our filesystem (above the webroot, so you can only get there via Drupal) and changing the field settings within the appropriate content type to use Private files as the Upload destination and then went to set a bunch of Custom permissions, so that the appropriate users have "View anyone's value for field Image" (and so on) but that Anonymous users don't.

Then I cleared all the caches and went to upload a new image. If I go to the node page and right click to get the image URL, though, pasting that into an Anonymous Browser Mode window still shows me the image.

So I figured maybe I just needed something more fine-grained or that I'd implemented it wrong.

So I enabled the Content Access module and went back to the appropriate Content type and set the Access Control settings so that only the appropriate rôles can "View any gallery_image content" (and so on). Clearing the caches, uploading another new image, I can still grab the URL and see it from a new Anonymous Browser Mode window.

Now the Private files thing seems to be doing the right thing — the image URL is now /system/files/styles/image_thumbnail/private/gallery/images/filename.jpg and the files are appearing in the right part of the filesytem, but Drupal doesn't seem to be respecting the access control — or even just requiring that you log in.

Presumably I've done something wrong somewhere, as it seems like I'm implementing the right thing and I've just made a mistake somewhere. So is there an obvious step I'm missing?

Update: The hosting environment is RedHat Linux and we don't allow .htaccess files (we're developing the site, a third-party is responsible for security, so they would rather everything go into the httpd.conf instead). This is part of why I deliberately close a directory above the webroot, so that a .htaccess file would not be necessary. I do notice, though, that if I try to access /system/files/styles/image_thumbnail/private/gallery/images/ in a browser, I get a Drupal 403 message, not the apache one.

Improve this question
3
  • Unfortunately I don't really have an answer for you. You're probably really close though, since everything you do sounds right. There was a question here recently about how to debug permissions, you may wanna try to find it.
    – Letharion
    Jan 17, 2012 at 20:05
  • What's your hosting environment? Linux, windows? In system/files do you see .htaccess file?
    – Jonathan Rowny
    Jan 17, 2012 at 20:41
  • @JonathanRowny: I've updated the question to answer those questions.
    – Owen Blacker
    Jan 18, 2012 at 13:29

2 Answers 2

Reset to default
5

I believe that this issue was fixed in SA-CORE-2012-002 - Drupal core multiple vulnerabilities instead of being posted to a public site like this. In the future something like this should be reported to the security team. And, if upgrading Drupal core doesn't fix your bug let's discuss more details by having you submit a new Core security issue where we can figure out what's going on in private and then, if appropriate, release a patch that fixes the bug.

Improve this answer
1
  • 1
    You're right, as it's actually a security bug, I should have reported it to the security team. I thought it was something I was implementing wrongly, rather than something wrong with Drupal Core, hence posting it here.
    – Owen Blacker
    May 3, 2012 at 10:21
2

I did a site similar to this also. My setup was nodeaccess to configure permissions on the gallery and setting the file system to private that way a user could not just browse to yoursite.com/sites/all/files/image.jpg this seems to be working great for me and it also gives you the ability to control other content types if you so choose. Not sure if this is going down the right path or not if you think it might help I would be happy to discuss it further with you.

Thanks, Justin

Improve this answer
1
  • I didn't look at using Nodeaccess (drupal.org/project/nodeaccess) because it's listed as being a Development release for Drupal 7. Do you find it works ok with D7? Looking at Nodeaccess, it looks like it's designed to do permissions granularly (on a per-node) basis, whereas I just want blanket permissions across the gallery; is this something that's easy to configure (possibly as a default per content type)?
    – Owen Blacker
    Jan 18, 2012 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.