I have an organic group with a file field that stores its files in a private directory (sites/default/files/private/). These files are visible only to members of that group. But, as is commonly known, if someone guesses the Drupal path even if he is not a member of that group or not even logged in, he can access that file by using the correct file link directly.

How can I restrict file access to group members?

  • Did you set up private directory in 'File system' in admin? Oct 28, 2013 at 5:00
  • @JayendraKainthola Yes, I did. But unfortunately (as mentioned in the docs) that does not prevent the access to the file, if someone knows the correct file link.
    – user5950
    Oct 28, 2013 at 8:19
  • Please try with other location in root directory. In mostly site, I used 'backup and migrate' module and create 'private' directory under root directory and set up 'File system' in admin and this is not accessible by other. Oct 28, 2013 at 8:40

2 Answers 2


OG provides no access control on attached files. I ran into the same situation and came up with two options.

The file depot module integrates nicely with OG and does prevent users who are not members of a group from accessing files that are attached to a group.

The filedepot module is full featured Document Management module that has a google docs like feel. It fulfills the need for an integrated file management module supporting role and user based security. Documents can be saved outside the Drupal public directory to protect documents for safe access and distribution.

Another option is writing a custom module that implements hook_file_download(). In that module you would have to get the node id of the file attachment then use that to determine what group the node belongs too then from there determine if the logged in user is a member of the group. If they are not a member of the group the module would return -1 which would give them access denied if they try to directly download the file via url.


What John said is correct. In open scholar there is an option for private files and groups. We then using hook_file_download and verifying if the user has the privilege for that(in the group level and also site wide level)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.