I have created a content type with file field and set Upload destination is private files. I have also set the $settings['file_private_path'] = '/path/to/private'. But the file is accessible by anonymous user.

  • Is the node visible for anonymous users? Sep 19 '17 at 11:44
  • Yes node is visible. Sep 19 '17 at 12:14
  • I guess you mean the uploaded file itself is directly accessible when entering the URL in browser? If yes, add a .htaccess file with access restrictions to this directory to prevent the webserver from directly serving the file
    – Hudri
    Sep 19 '17 at 12:16
  • @RajeshVishwakarma Then it makes sense. Drupal by default does not have access permissions per file, so it inherits the permissions from the entity it is attached to. If a user can see the node, he can also see any private files attached to the node. In Drupal 7 this could be solved with file entity, which allowed permissions to be set per file type. For Drupal 8 I am not sure yet. They are moving media entity to core, but it is not yet complete. For now media entity might still work. Sep 19 '17 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.