0

I have a private organic group with a private organic groups post. I have properly setup my private files system. If an image is uploaded to the private folder an anonymous user can still access it with the following URL:

/system/files/private/assets/image.jpg

However they are given a Forbidden: You don't have permission to access this on this server when access the URL this way:

/sites/default/files/private/assets/image.jpg

My guess is that Drupal is not doing it's job in the first instance; as I haven't set up private file system properly and Apache is doing it's job in the second URL due to the htaccess file in there.

Any pointers?

Improve this question
13
  • Can't comment as to why, but this module should help solve the problem
    – Clive ♦
    Aug 16, 2013 at 15:53
  • I'll give that module a go and see what we can do, however, my understanding is that whatever permissions are protecting the node should be protecting the files/images tied to that node. I know the og permissions are working as an anonymous user cannot view the node directly, but they can access the files/images directly that are attached to that node (even though they are in the private folder).
    – Nigel Waters
    Aug 16, 2013 at 16:13
  • Are the files/images attached via a field?
    – Clive ♦
    Aug 16, 2013 at 16:25
  • Looking at file_file_download(), access to files attached to fields (not images, those are handled separately) is based on an invocation of hook_file_download_access(). No core modules implement that hook so I get the impression it's left to the developer to implement. I might be wrong, that does seem a bit suspicious. But as far as I can tell from the code it's right
    – Clive ♦
    Aug 16, 2013 at 16:33
  • I have attached one to an image field and the second is in the body field. Both are in the same private folder. I have given that module a go and interestingly enough, just enabling the module makes Drupal behave as expected. I haven't even defined any directories to protect through the module yet. Also, I don't think this module will do it because it is based on site permissions, not og group permissions.
    – Nigel Waters
    Aug 16, 2013 at 16:40

1 Answer 1

Reset to default
1

/sites/default/files/private/assets/image.jpg will never work because of an .htaccess directive prohibiting direct access to that directory.

Beyond that, this strikes me as an issue with OG. I'd try executing a module_implements('file_download') and have a look at what modules might be interacting with determining if a given file is accessible.

Improve this answer
1
  • So this is indeed an issue with OG, however there is some funky stuff going on in Core as noted in my conversation with @Clive above. It seems that my expectations of core is that it should protect access to the files directly unless they are being view through the node. It also appears to be hit and miss with other access control modules, whether or not they are also implementing a file access function. For the specific issue for OG, see drupal.org/node/985656
    – Nigel Waters
    Aug 16, 2013 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.