1

My company inherited a Drupal 7 site that may not have been properly set up. For example I recently noticed that under Configuration, File System, the "Public file system path" and the "Private file system path" have the same path:

sites/default/files

I'm just wondering what the repercussions might be if I suddenly changed the private files to

sites/default/files/private

Is it too late for this, since there might be sensitive private files already there that can't just be moved because they're registered in the database? I haven't looked too closely at the files yet.

Thanks

Improve this question

1 Answer 1

Reset to default
2

The private files path should always be outside the webroot directory since users can directly access all those files through just adding /sites/default/files/private/.. to your URL. Private files means that they are delivered through Drupal to add some access permissions.

What you should do now:

  1. Backup your databse and put your site into maintenance.
  2. Go to your files_managed table and find all files stored as private files.
  3. Move those files to a new directory outside your webroot.
  4. Change your private files path to the new path and test if everything is working.
Improve this answer
2
  • Your suggestion looks like a good one. Thanks for the answer. Private and Public folders need to be separated and to do that requires redefining them in the db and moving private files to a new location. I'm now wondering, if adding a /private folder below the /files folder would be an option, as long as permissions and htaccess are set correctly.
    – P Tocco
    Commented Mar 21, 2017 at 13:54
  • I would not recommend that. All files in the sites folder should be known to Drupal as public files.
    – schlicki
    Commented Mar 22, 2017 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.