I have member area on my site, and there i have files available only to members. (also, not to all members, but to members of some role, and also they are further granulated by field condition, but that is a long story :)

But technically, anyone can download a file, if knowing the link to the file.

I would like to prevent downloading files by direct link, or by being logged of site.

It would be perfect if i can execute a script when someone asks for file by direct linking, to check if user is logged in, if he has a role that grants him download.

But if that is not possible, i would like to disable accessing files directly, they should be only accessible by browsing the site.

Thanks for clues


Have a look at hook_file_download

Control access to private file downloads and specify HTTP headers.

This hook allows modules enforce permissions on file downloads when the private file download method is selected. Modules can also provide headers to specify information like the file's name or MIME type.

| improve this answer | |
  • Thanks! How is private file download method selected ? My files are stored in public folder, though. – NenadP Oct 11 '12 at 8:02
  • 1
    Have a look at the API. It sais: "If the user does not have permission to access the file, return -1". So it's up to you to return -1 whenever you think that a user should not access that particular file. Also, files in the public:// folder go through Drupal and this hook as well. – cherouvim Oct 11 '12 at 8:17
  • @cherouvim public files don't go through Drupal, they are served by web server. Thus, this hook won't be called for public files. – Елин Й. Sep 12 '15 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.