D7 - download files works for admin, not for other users

Question

There is a content type for accepting job applications, including resumes and cover letters as files uploaded. The files are set to private.

The form/page is set to unpublished by default - largely to 'fix' some other wonkiness.

Users with admin privileges have no trouble downloading the resume and cover letter files.

The more limited users in HR cannot - Drupal returns a message

You are not authorized to access this page.

I've been tweaking permissions trying to find the magic bullet. The HR user can 'Edit' the individual's application form, but even though the associated resume or cover letter file is shown as a link, once again, the HR role is not authorized.

Any ideas what permission I need to toggle? What's blocking the ability for the HR role to download the file?

Answer 1

As you setup the content type default as unpublished, this will prevent any one to see the individual content but the author of the content(if he or she has permission to "View own unpublished content") and User with the privilege of "Bypass content access control" which probably you don't want to give it to any one but admin, so basically there is a better approach to this :

I recommend to

1) setup content type default as published

2) Setup Content Access module http://drupal.org/project/content_access

3) Setup content type access permission by Content Access module.

3-1) Use Content access module to prevent any user but HR to have access to the specified content type. This will prevent any one to have access to following content type but HR, so you don't need to worry about content being published.

3-2) give permission to the specified rules (maybe anonymous or authenticated) to be able to create the specified content type.

Note: Don't do this in production environment, first test it to make sure everything is as you want it since "content access" module will rewrite your current website permissions.

If it still seems confusing let me know I will add photos to explain it.