I'd like to create a restricted area from scratch using views.

What I'd like to achieve:

  • The admin creates a photo album and assigns it to a photographer
  • A photographer is able to log into the site, and see a list of albums that are assigned to them
  • The photographer can upload photos to the album
  • If a non logged user tries to access the album by typing its url, they get rejected
  • Ideally, photos (the files themselves) that are in an album are also protected, I know that file access restriction is a complex subject, but I'm okay with a sort of proxy-page that would then redirect to the file with an unguessable url, or a solution of this type.

Where I am so far:

  • Create a user role Photographer
  • Create a content type album with fields:
    • Photographer (user reference, role=photographer)
    • Photos (file, number of values unlimited)
  • Create a view to list content type=album, with a contextual filter on the Photographer field that defaults to current user id when not provided in the url. So that a logged photographer only sees their own albums. That works fine.

My problem:

  • Anyone can enter an album's url and access it directly [solved]
  • Anyone can enter a photo's url and download it [solved]

I've built this on drupal 8 but can also use drupal 7 and other modules. Any help would be very much appreciated!


I think I found part of the answer. Using private directory with the files module: https://www.drupal.org/documentation/modules/file. According to the docs:

For example: you have created a new content type with a file field which stores files in your site's private file directory. Next you create a node from this new content type and attach two new files. When the node is published links to both attached files are visible and anyone who can view the node may download the files. Now, if you unpublish the node, all attached files become inaccessible for download even if you use the direct link to the files that worked when the node was published.

2 Answers 2


Have a look at the Group module which allows for creating arbitrary collections of your content and users on your site, and grant access control permissions on those collections. It is available as of D7, and has a D8 version also.

The Group module creates groups as entities, making them fully fieldable, extensible and exportable. Which also makes it integrate very well (out of the box) with commonly used modules such as Rules, Views, etc.

For more details about the various roles and permissions, refer to my answer to "What are the various roles supported by the Group module?".


  • Hi, thanks for your reply. I had a look at Group module. However it seems to restrict access based on groups, not based on resources. In my case, I need each photo album to be restricted to a given user. Do you think I can achieve this with Group module?
    – gkpo
    Commented Oct 19, 2016 at 18:19
  • @MonsieurNinja Using the group module, ie the gnode sub-module, you'd typically configure "access" to nodes, which in your case would be the nodes of content type "album". And for anything that you impement as a view, you'd configure who has access to the views "results" (= a set of nodes of content type "album"). A possible config for your case, IMO, is that you'd have 1 group for a given user. Note: what's the difference between a "photo album" (created by an admin) and a node of content type "album"? Commented Oct 19, 2016 at 18:31
  • They are the same. Well, I can't really have a group for each user since ultimately users should be able to sign up and so the group creation should be automated.
    – gkpo
    Commented Oct 20, 2016 at 8:49
  • @MonsieurNinja To automate things, you might be able to use the Rules module for it ... Commented Oct 20, 2016 at 12:11

So I ended up using Drupal ACL Module which allows to grant access to a node to a group or user. This way, if one tries to access the node by entering its url, they get rejected: https://www.drupal.org/project/acl

I also made use of Drupal protected node to allow node access via password without being logged: https://www.drupal.org/project/protected_node

And I implemented a few Rules with drupal rules: https://www.drupal.org/project/rules

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.