4

I am using drupal 7. I created a new file field in private messages for attachments and I want that only sender and receiver should be able to download the file attachment.

I apologize if this question is duplicate but I didn't find the answer for this.

EDIT: Just one addition. I am using Custom Field permissions module as well. And authenticated users are unable to see the attachment until "View anyone's value for field" is enabled for them.

Improve this question
4
  • Hello and welcome to Drupal answers. Please explain what is happening right now. Is everyone can able to see file or Download file using direct link ?
    – Anil Sagar
    Oct 31, 2012 at 5:46
  • Are you sending the file download link in email ?
    – GoodSp33d
    Oct 31, 2012 at 6:41
  • Anil, Yes everyone can download the file using direct link. kantu, I am not sending attachment in email notification.
    – qasimzee
    Oct 31, 2012 at 6:44
  • With custom field permissions, I am able to resolved it. I have allowed every authenticated user to see the file field. Private message module itself manages not to show other authenticated users the private file using direct link sent using PM. Moderator, should I add this as an answer?
    – qasimzee
    Nov 1, 2012 at 5:25

2 Answers 2

Reset to default
1

Your question is fully answered here http://drupal.org/documentation/modules/file

Please read sections:

  • Managing file locations and access
  • Accessing Private Files

You can also specify whether files are stored in a public directory or in a private file storage area. Files in the public directory can be accessed directly through the web server; when public files are listed, direct links to the files are used and anyone who knows a file's URL can download the file. Files in the private directory are not accessible directly through the web server; when private files are listed, the links are Drupal path requests. This adds to server load and download time, since Drupal must resolve the path for each file download request, but allows for access restrictions.

Improve this answer
2
  • Thanks for the reply Eugene. I have read the link you provided and files are in private directory that I have configured using filesystem options. The problem is that I want that only sender and receiver should be able to download the file even with the direct link. Unfortunately I can't do it using field permissions for obvious reasons.
    – qasimzee
    Oct 31, 2012 at 11:39
  • For finer grained control of who can see/download attached files you will need an additional access control module. You may write a module yourself, or use a contributed module such as Content Access.
    – Eugene Fidelin
    Oct 31, 2012 at 12:33
1

File attachements in a private file storage area can only be viewed by the person that has view permission granted to node the private file is attached to. Even if the URL of a private file attachment is known, access will be denied if the person trying to access the file is not granted the permission to access the node the file is attached to.

To control access to nodes with files attached, you can write a custom module that use the API of the ACL module to automatically create an access control list for a the node with the file attachment, consisting of only the sender and receiver of the email, when a file attachment is created or sent.

To test out the concept without having to create a custom module interfacing the ACL API, you can use the Flexi Access module. It has a GUI that lets you maintain ACLs to any node.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.