0

I need customers to be able to access certain documents (PDFs mainly) specifically for them (they contain sensitive information). The document information is setup in nodes. I have looked at a lot of access control modules, but they all seem to focus on user roles. I don't want a role for every customer. What would be the best way to structure this?

  • 1
    Sounds like a job for the Groups module + private file/media setup. – Kevin Jul 30 '18 at 16:12
  • Again, it seems like you have to set up 1 group for every customer. We have a lot of customers and this seems like a lot of extra overhead. All the documents are individualized, although customers could have 5-10 documents. – N Nason Jul 30 '18 at 16:51
0

A possible (but somewhat convoluted) solution could be to use Node access user reference module with private files setup. Basically adding a user reference to a node will allow them to see its content (including files) and having files' folder protected will prevent direct access to the file urls.

  • This looks like a possibility, I'll check into it. What do you mean by "somewhat convoluted"? – N Nason Jul 31 '18 at 14:48
  • well I've personally never done anything like it as we tend to write custom code for things like this. Usually only relying on a contrib module gets you only 90-95% of a solution to a fairly complex problem. So just make sure to test all the edge cases (especially if security is important) to make sure everything is in order. – kombogdan Jul 31 '18 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.