I have a private organic group with a private organic groups post. I have properly setup my private files system. If an image is uploaded to the private folder an anonymous user can still access it with the following URL:
/system/files/private/assets/image.jpg
However they are given a Forbidden: You don't have permission to access this on this server when access the URL this way:
/sites/default/files/private/assets/image.jpg
My guess is that Drupal is not doing it's job in the first instance; as I haven't set up private file system properly and Apache is doing it's job in the second URL due to the htaccess file in there.
Any pointers?
file_file_download()
, access to files attached to fields (not images, those are handled separately) is based on an invocation ofhook_file_download_access()
. No core modules implement that hook so I get the impression it's left to the developer to implement. I might be wrong, that does seem a bit suspicious. But as far as I can tell from the code it's right