0

I have case where I want to make it impossible for the users to access file directly (http://www.mydomain.com/members/file.pdf), but want to allow downloading this file only if link is displayed on Drupal page, that user has privilege to see.

I know it can be easily done if those files are outside webroot and defined as private filesystem.

But is there any alternative solution, Apache way, php/Drupal way to achieve this for files that are not in private filesystem?

Those member files are of various extensions, so I could not just disallow by extension.

I have asked simmilar question before, but as I understood, proposed hook_file_download way works only for private file system setup.

  • 2
    Drupal has a built-in private file system, which can be easily customised in code. Have a look at Working with files in Drupal 7 for a bit more info, it might come in useful – Clive Mar 18 '13 at 15:24
  • tnx clive, actually im using it for some other case on the same site. But now i face a need to protect very big structure of files that are under standard filesystem. I can migrate them to private, but it will require lots of work. As i hold apache in my hands also, im hoping to have chance to protect them in place if possible/ reliable. – NenadP Mar 18 '13 at 17:02
1

To Apache or any other web server, seeing

<img src="http://www.foo.com/bar.jpg">

in html and a user typing http://www.foo.com/bar.jpg into their browser directly is basically the same thing so the quick answer is "no, not really, at least from a drupal standpoint." You could obfuscate the path with some javascript trickery but that's about it.

Now, you could look into Apache referrer access, a quick link about allowing access from specific referrers might shed some possibilities on it for you, but now you are certainly outside of drupal :)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.