I have an organic group with a file field that stores its files in a private directory (sites/default/files/private/). These files are visible only to members of that group. But, as is commonly known, if someone guesses the Drupal path even if he is not a member of that group or not even logged in, he can access that file by using the correct file link directly.
How can I restrict file access to group members?
OG provides no access control on attached files. I ran into the same situation and came up with two options.
The file depot module integrates nicely with OG and does prevent users who are not members of a group from accessing files that are attached to a group.
The filedepot module is full featured Document Management module that has a google docs like feel. It fulfills the need for an integrated file management module supporting role and user based security. Documents can be saved outside the Drupal public directory to protect documents for safe access and distribution.
Another option is writing a custom module that implements hook_file_download(). In that module you would have to get the node id of the file attachment then use that to determine what group the node belongs too then from there determine if the logged in user is a member of the group. If they are not a member of the group the module would return -1 which would give them access denied if they try to directly download the file via url.
What John said is correct. In open scholar there is an option for private files and groups. We then using hook_file_download and verifying if the user has the privilege for that(in the group level and also site wide level)
