For a project I'm working on, I need to be able to:
- Upload a file as Admin, assigning it to a user (this is working using the "author" field at the moment), attaching it to a node (ie. using the "FileField" field type)
- Store the file in a private directory (not accessible by public users)
- Allow the Admin and "author" users to download the files
We've setup a test project using Drupal 7 with a FileField on a custom content type. The FileField is set to use "Private" uploads.
What seems to happen is that the files are not accessible by their path on the disk (e.g. http://sitename.com/sites/default/files/filename.pdf) but are accessible by the Drupal private file download path (e.g. http://sitename.com/system/files/filename.pdf) - even when users aren't logged in, the private file download path still allows the file to be downloaded.
What we need to do is:
Stop users who aren't logged in, and aren't the author or admin of the node, from downloading the file from the private path.
We've already got a hook_node_view() in a custom module which stops people looking at the node if they don't have permission (i.e. the $user->uid matches the $node->uid) - it's just the private file path we need to hook and validate (check the user is accurate).
Any ideas what we're doing wrong?