I have created system settings form for an image using managed_file.

$form['my_image'] = array(
  '#type' => 'managed_file',
  '#name' => 'Upload Image',
  '#title' => t('Upload Image'),
  '#default_value' => variable_get('my_image', ''),
  '#description' => t("Here you can upload setting image!"),
  '#upload_location' => 'public://my_image/',
  '#upload_validators' => array(
  'file_validate_extensions' => array('jpeg png svg jpg'),
  '#required' => TRUE,

How can I add the file view/download access on this file based on role?


It looks like the Field Permissions module is the answer to your case.

UPDATE: You could also use '#access' in your field definition, see this post

| improve this answer | |
  • Does that work for FormAPI fields? – Kevin Dec 27 '18 at 19:11

I have fixed this using hook_file_download hook-

 * Implements hook_file_download().
function my_module_file_download($uri) {
  // Allow to view/download only Authenticated user.
  global $user;
  if (in_array('authenticated user', $user->roles)) {
    if ($cpdf = variable_get('checklist_pdf')) {
      $file = file_load($cpdf);
      if ($file->uri == $uri) {
        return array(
          'Content-Type' => file_get_mimetype($uri),

And change upload_location as private '#upload_location' => 'private://my_image/',

A module is also available Private files download permission for this.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.