I just ran into a situation where access to private files changed after its deleting parent node. I confirmed that anonymous users do not have "View private files" permission. If the node is unpublished, access to the file is denied. If the node is deleted, then access is granted to file by anonymous users.

It looks like this has been addressed in the past, but after reading (and re-reading) the issues below, I couldn't identify if this is a bug that needs to be re-examined in 8.4 or if things are working as designed and I'm soliciting feedback as a result.

The file_entity module is also in-play on the site and the following issue may be particularly salient.

See also:

"Private files that are no longer attached to an entity should not suddenly become accessible to people who couldn't see them before"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.