3

On my Drupal 7 install, I have content type in which user can upload files to the server, via file upload field. I was sure everything was fine, I forgot about the system (was sure it was working, tested it). But strange enough, after some time I tested it, I could not download files, not by clicking on file link on that content type, nor by pasting url of the file in adress bar.

When I tried to access files, I got HTTP request status: 403 (Forbidden in http headers, while browser shows login page and path in the adress bar was path of that file...

And strange enough, under /admin/config/media/file-system I defined private files path to be files/private, and files were uploaded to that directory. But on the content type page - link to file ignored files/private path and rather had path system/files that I have not defined anywhere!

To test things, I migrated user private files to system/files (actually created that folder and subfolder in drupal root) and defined path of the private files to be also system/files (on /admin/config/media/file-system ).

Got some "progress" - Apache "Forbidden" page - when acessing private files. There was .htaccess file in the folder, with config

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Deny from all
Options None
Options +FollowSymLinks

And for test, I renamed that file to bypass "Deny", and voila, I could access my newly uploaded files. But previously uploaded files still throws mysterious HTTP request status: 403 (Forbidden in http headers, while browser showed login page and path in the adress bar was path of that file...

I was using Public local files served by the webserver. under /admin/config/media/file-system. I noticed also, when I enter that config, if I am missing .htaccess file in private files dir, a new one is being created.

I have to mention that I implemented Varnish cache and APC in Drupal, but things are not better after clearing the cache.

Could someone please tell me what is happening and how I can set it to work correctly/securely? Thanks!

Improve this question

2 Answers 2

Reset to default
3

Although and older issue, it's worth noting that system/files is normal for Drupal private file mode paths.

That is because system/files is the logical application path that handles and routes to the file on the actual file system.

It is this logical path that allows the additional authentication checks that private file mode allows.

You can put your private files under sites/default/files/private and Drupal will automatically create an .htaccess file to deny direct web access to them.

However, for safety, it's recommended to put your private files directory outside the html web root. For example, one level up from your website document root, or some other designated folder.

If curious private files are served via system_menu which defines the system/files url callback to file_download.

Following that hook_file_download is used to provide access control to the requested private file.

Improve this answer
1
  • nice in depth explanation about private file system and also for sharing info about additional .htaccess file in private directory(I was just looking in root .htaccess file for debugging). Also facing private file system problem @ drupal.org/node/1438940#comment-9730243 and couldn't find any solution yet. Could you please have a look at it? or shall I have to create another isssue here @ SO.
    – kiranking
    Commented Jun 23, 2015 at 6:52
0

Make sure that the permissions on you private files directorie are correct.

Also check the status report /admin/reports/status and the recent log entries /admin/reports/dblog for clues about why it is going wrong.

Improve this answer
1
  • aye, permissions are set to allow, and dblog shows nothing interesting, (clues), it shows that permission is denied, though, but not why :)
    – NenadP
    Commented Jan 10, 2013 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.