I have a series of file fields on a user account where users can upload files. These files need to be attached to emails (by the system with drupal_mail) and removable by the user.

But they don't actually need to be downloadable. And it would be a nice extra level of security if they can't download the files, only upload, remove and upload again.

Has anyone ever tried this (admittedly fairly niche) idea before?

  • It's called private filesystem. Investigate it a bit, there is API just for cases like yours. – Mołot Dec 16 '13 at 15:44
  • Cheers Molot, I didn't realise I could do it with private files and content access. – Dominic Woodman Dec 17 '13 at 0:16

As it turns out this functionality was possible with only one extra module, the Content Access module.

Select the file field on the user account. You can find them at the following path:


Edit the field and under permissions select, custom permissions. You'll need the Content Access module installed for this to work.

Then in permissions you can set custom permissions for the field. To allow a user to upload and not download, you give them only the ability to create or edit their field. You don't give them the permission to view it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.