I'd like to create a restricted area from scratch using views.
What I'd like to achieve:
- The admin creates a photo album and assigns it to a photographer
- A photographer is able to log into the site, and see a list of albums that are assigned to them
- The photographer can upload photos to the album
- If a non logged user tries to access the album by typing its url, they get rejected
- Ideally, photos (the files themselves) that are in an album are also protected, I know that file access restriction is a complex subject, but I'm okay with a sort of proxy-page that would then redirect to the file with an unguessable url, or a solution of this type.
Where I am so far:
- Create a user role Photographer
- Create a content type album with fields:
- Photographer (user reference, role=photographer)
- Photos (file, number of values unlimited)
- Create a view to list content type=album, with a contextual filter on the Photographer field that defaults to current user id when not provided in the url. So that a logged photographer only sees their own albums. That works fine.
My problem:
- Anyone can enter an album's url and access it directly [solved]
- Anyone can enter a photo's url and download it [solved]
I've built this on drupal 8 but can also use drupal 7 and other modules. Any help would be very much appreciated!
Update:
I think I found part of the answer. Using private directory with the files module: https://www.drupal.org/documentation/modules/file. According to the docs:
For example: you have created a new content type with a file field which stores files in your site's private file directory. Next you create a node from this new content type and attach two new files. When the node is published links to both attached files are visible and anyone who can view the node may download the files. Now, if you unpublish the node, all attached files become inaccessible for download even if you use the direct link to the files that worked when the node was published.