In my website I have these modules enabled: File Entity (fieldable files), Media, Rules, Entity reference.

The default download method is: Private local files served by Drupal.

So when userA upload file to node. userB can't see it.

Q: How to give access to view file by entityreference(user) for userB?


I create subdomain http://filesaccess.onenglar.com/

So you can login:

user: root

pass: root


Sharing access i think by entity reference field (user)

But how share access to the files of node for individual users?))

enter image description here

  • 2
    The questions is not cleaer, I suggest you to explain in more detail your exact current setup and what exactly you want to achieve.
    – sanzante
    Commented Jun 8, 2016 at 15:05
  • 1
    @OnengLar: What do you mean by "can't show it"? Maybe you mean "can't see it"? If my guess is right, who or what is stopping userB to actually see it? Also, what do you mean by "by entityreference(user) for userb"? Maybe you mean "userB is only allowed to see if there is a link to userB via some entityreference fiel"? Sorry for being confused, but please try to edit your question to address these questions (to make them obsolete). Commented Jun 8, 2016 at 17:01
  • userA and userB are of the same role ? If yes it's kind of strange that they can't access files independently on who has uploaded them.
    – mchar
    Commented Jun 8, 2016 at 17:38
  • I tried your demo site. It seems both test and test2 can't view the image.
    – Jimmy Ko
    Commented Jun 8, 2016 at 18:21
  • I enabled View private files permission for authenticated user. All users can view the image now.
    – Jimmy Ko
    Commented Jun 8, 2016 at 18:23

3 Answers 3


To do the access checking yourself you'll need to write a hook_file_download().

In broad strokes you'll need to get the actual file object (see this question for help with that), find the references with file_get_file_references(), and finally load them to check each reference (probably just one but it would be unwise to assume that's true) to see if the current user is given access to the file.

  • Thanks! q: You offer to work with the public system?
    – OnengLar
    Commented Jun 12, 2016 at 12:56
  • I'm sorry, but I'm not sure what you're asking? Will this solution work with a file in the public file system: probably not (Drupal isn't bootstrapped in that case)? Or do I do freelance work?
    – acrosman
    Commented Jun 12, 2016 at 20:35
  • the first one..
    – OnengLar
    Commented Jun 13, 2016 at 8:31
  • 1
    Mostly: No, since your web server will serve that file directly without consulting Drupal. If you want control over file access when it is served you need to use private files (which is also slower). That said, you could still control when and how the page with a public file is rendered by using hook_node_view() or hook_node_view_alter() to change what's loaded and displayed, but the images themselves will still be accessible directly.
    – acrosman
    Commented Jun 13, 2016 at 13:23

It appears to me that he just wants to show/print the picture only if the logged in user is the same as the entity reference user or is the node author.

Sorry I don't have time to write an explicit answer. Consider this an implicit or bare bones answer.

All you gotta do is create a template file for your content type.

Then in your template file with PHP use Global User to grab the current logged in User ID. Also, you will need to grab the User ID of the entity reference field, perhaps the raw value will have it? Use Devel to check that.

Almost forgot, you will also need the node author uid.

Once you have these 3 values, you do a simple check

if ($global_uid == $entity_reference_uid || $global_uid == $author_uid) {

print render($content['field_image']);  


If anyone wants to write a more explicit version of my answer, feel free.

  • Thanks! Your solution good for public file system, but then, any user can access any files from url
    – OnengLar
    Commented Jun 12, 2016 at 12:52

Here is some pseudocode (inasmuch as you'll need to do the work to get the CURRENT_USER_ID and ENTITY_REFERENCE_ID) that should work in a custom module:

function MYMODULE_file_download($uri) {
      return -1;
  else {
      $info = image_get_info($uri);
      return array('Content-Type' => $info['mime_type']);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.