So I have been setting up my Drupal 8 installation and I'm having troubles with my private folder setup.
I went on to settings.php
and specified the path which I wanted for my private folder as sites/default/files/private
. It seemed to be working well for a while, but now it isn't.
I have configured Drupal to use the private folder as default location for file uploads and it shows the sites/default/files/private
path as the private folder path.
Now my issue is that I created a custom content-type with a private folder file upload field. This is for a restricted area I have in the website which I only want authorized (logged in) users to be able to access - both that area, and the files linked there.
The area was successfully blocked via role permissions and works great. The files attached to content - even though the content-type settings are explicitly and correctly set to use the private folder for upload - result in the following behavior:
- files served by direct HTTP in
sites/default/files
are accessible, regardless of Drupal login state - as intended - files served by direct HTTP in
sites/default/files/private
are blocked with a 403 forbidden by NGINX regardless of Drupal login state - as intended - restricted files served by Drupal in the restricted area with an URI similar to
system/files/YEAR-MONTH
don't show Drupal's access denied 403 page (the intended effect), BUT INSTEAD:- if they are images, I get an NGINX 404 NOT FOUND error page
- if they are other file-types, they are accessible without restriction (exactly what I'm trying to prevent).
Right now I'm lost as I've been searching around for answers on these issues, but I can't seem to find them.
I'm using a shared web server setup in which I don't have direct access to NGINX's .conf
files. I'm also using the IMCE File Manager module. I think that the images issue is related to some NGINX conf and as such I'll have to contact the web server maintainer to fix it, but I'd like to have some insight to share with them about this. Also, what can possibly explain the files being uploaded to the private folder being accessible without any restriction?
Any help would be very welcome, thanks!