I am having problems denying access for anonymous users to private files. Having looked into the logs for hook_file_download() - the issue seems to be that whenever a user does NOT have access, it will still return NULL (not -1), indicating the module does not control (access for) the file. However, in my case no other module or hook implementation is denying access, basically granting access to anyone instead.

The patch causing the issue seems to be this one: https://drupal.org/comment/7764977#comment-7764977

There is a check for file_entity_access('view') but whenever this returns FALSE (e.g. when access is denied) hook_file_download will simply return NULL instead - I think the code here needs to be split up further to first determine IF file access is handled by File entity, and if it is, NEVER return NULL, but return either the file headers, or -1 if access should be denied.

CommentFileSizeAuthor
#3 cannot_deny_access_private_files.patch290 bytesFreekVR
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

FreekVR’s picture

FreekVR CreditAttribution: FreekVR commented
Related issues: +#2064129: Cannot download private images anymore
ericwongcm’s picture

ericwongcm CreditAttribution: ericwongcm commented

Someone posted at fix here.
https://drupal.org/comment/8173505#comment-8173505

Someone please put this into file entity code.

FreekVR’s picture

FreekVR CreditAttribution: FreekVR commented
FileSize
cannot_deny_access_private_files.patch290 bytes

I'm afraid the linked issue is a different issue. Attached is a patch we are now using. The downside of this patch is that it totally limits access to the permissions set for the entity bundle in this module. Previous to this patch the access was handed off to the node module in case the file was uploaded to a node.

The downside of the approach as it was, is that effectively the permissions for this module only allow you to open up access to anyone, and removing said permission for a certain role does not mean that they will be unable to access the file.

Some thought needs to go into the whole approach this module takes to file permissions. If the above description is how it is *intended* to work, I think the descriptions for the permissions need to change.

In our case, the client specifically requested for private files to be downloadable only for logged in users, regardless of the permissions that user has to the node it was uploaded to. Only by using this patch can we regulate it using the permissions already provided by the module.

FreekVR’s picture

FreekVR CreditAttribution: FreekVR commented
Status: Active » Needs review
Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented

I have the same issue with public files!!

To Reproduce the public files strange behavior:

  • Manage display of a content type with file, use Download Link as file format.
  • Permissions are on for : View files, download any files

visit the page and click download the file, it will allow download for couple of times then it will redirect to access denied page!

klaasvw’s picture

klaasvw CreditAttribution: klaasvw commented
Status: Needs review » Reviewed & tested by the community

I also had a similar problem. This patched fixed the issue for me, see #2268335: File permissions ignored for private files

aaron’s picture

aaron CreditAttribution: aaron commented

3: cannot_deny_access_private_files.patch queued for re-testing.

aaron’s picture

aaron CreditAttribution: aaron commented
Status: Reviewed & tested by the community » Fixed

Committed to http://drupalcode.org/project/file_entity.git/commit/b08ed87.

  • Commit b08ed87 on 7.x-2.x by aaron: 
    Issue #2164527 by FreekVR: Cannot deny access to private files

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

znerol’s picture

znerol CreditAttribution: znerol commented

Note, this has been reverted by #2351691: Access denied when downloading private files - decide if file_entity_file_download() should deny access by default or not.

znerol’s picture

znerol CreditAttribution: znerol commented
Related issues: +#2351691: Access denied when downloading private files - decide if file_entity_file_download() should deny access by default or not