Private File System and User Access

Question

Is there a way to protect Drupal files from being accessible by the file path (putting http://www.domain.com/files/image.jpg) in the browser URL from users poking around?

Answer 1

You can choose to let Drupal handle all file requests, this is done under file settings be selecting private files (admin/settings/file-system).

The access check is done in hook_file_download.

You should be aware that doing this will slow down the process of loading the files as Drupal has to be bootstrapped for every file that needs to be downloaded.

Update

The above method works be changing the file path created by file_create_url to a path that looks something like this: system/files/[path]. But I don't actually think that it prevents users from accessing the file directly. This would have to be setup in your webserver of choice. So all files would be protected that implement use file_create_url which should be any file/file link. Drupal also add some handling core files like user profile images. That leaves the access handling for all other files to you, which means you could allow imagecache files, while denying the original or whatever you like.

Answer 2

I see two ways of doing that:

1. Change the "files-mode" to private via admin/settings/file-system (as googletorp stated) AND changing the filepath to somewhere outside of your webserved files.

2. Change the "files-mode" to private and set some rewrite rules inside your .htaccess (or elsewhere in your webserver config). this gives you more control which files you want served private and which public. Something like:

   RewriteEngine On
   RewriteCond %{REQUEST_URI} ^/sites/default/files/(private/.*)$
   RewriteRule ^.*$ /system/files/%1 [L]
   

Now every request directly to the "private" files will be rewritten to the systempath which is controled by drupal. So no access without drupal is possible.