Role level file access control

Question

I have been asked to control access by different groups of users to files uploaded to a website.

This covers both files uploaded as a field, and files uploaded via IMCE and CKEditor.

I have several Roles to handle; Anonymous users, Authenticated Normal User, Authenticated Coordinator. And probably some more later.

There are already Permissions controlling access of users to relevant nodes and forum topics. For example, an anonymous user can only see the public part of the site, the normal user can see some content types and forums and coordinators can see everything a normal users can see as well as some extra forums.

I need files uploaded by authenticated users in the restricted part of the site to 100% not be accessible to anonymous users. And, I need documents uploaded by the coordinators to not be accessible by the normal users.

Currently, normal users can bypass the node and topic permissions to access files if they have the direct link.

How should we approach this?

Answer 1

The first step is using private files, because you can not control access to to public files as Drupal is not involved when they are delivered.

Private files in plain file fields (file and image, not media entity) automatically respect node access and will only be accessible if the user has access to at least one node that is using the file.

As you mention that users can bypass node access, I assume you have node access already implemented and it should then just work