I have a file attached to a node via a link. The node is published but the file is unpublished. The link on the node points to the file /sites/default/files/file.txt

The file is still downloadable by anonymous users.

I would assume the file, being unpublished, would be unavailable to download. This is not the case.

The anonymous permissions are set to view published content.

Is this expected behaviour? What would be the best way to not allow the file to be downloaded once it's unpublished?

  • That is a direct link to a physical file, there is nothing checking user access first, and its in the public files directory so the web server has no reason not to serve it. – Kevin Sep 18 '18 at 15:55
  • Thanks Kevin. Would you be able to advise what the best method for overcoming this is? – BearWithNoHair Sep 18 '18 at 16:11
  • For clarification, which version of Drupal are you running? – Shane Birley Sep 18 '18 at 17:43
  • I am using Drupal 8. – BearWithNoHair Sep 18 '18 at 18:45

You need to setup a private file system in settings.php:

 * Private file path:
 * A local file system path where private files will be stored. This directory
 * must be absolute, outside of the Drupal installation directory and not
 * accessible over the web.
 * Note: Caches need to be cleared when this value is changed to make the
 * private:// stream wrapper available to the system.
 * See https://www.drupal.org/documentation/modules/file for more information
 * about securing private files.
# $settings['file_private_path'] = '';

Files stored in the private file system will be served by Drupal and you can control which users are allowed to access the files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.