By JonathonCarlyon on

I have files I only want particular user roles to be able to access. These files will be stored inside a custom content type. The view that they're actually displaying on has the correct access assigned to it, but I noticed even with the private file path anonymous users can still access the files if they have the URL.

What is the best way to secure these files?

⋅ Categories: Drupal 8.x

Comments

RWill’s picture

RWill commented

Store the files in a private directory. This article (https://www.drupal.org/documentation/modules/file) houses the instructions for setting up a private file system.

JonathonCarlyon’s picture

JonathonCarlyon commented

I set the file system private, but I'm still confused on how to restrict access without use of a third-party module. From my understanding the files are private unless it is used on a published node, at which point anyone with access to the node has access to the file. So keeping the nodes unpublished removes them from view, but keeping them published means that anyone can access them. My end goal is to have these node's content (including file) come up in a view only for a particular role (access: desiredRole), but make the nodes/view inaccessible to anonymous users.

As the guy commented below this is probably easier to create a very small module for, but I want to better understand Drupal since it's clear I'm lacking the fundamentals.

RWill’s picture

RWill commented

Private files are not dependent on the node state (published, unpublished,etc). Files are made private by storing them in a folder on your server which is 'writable by Drupal and not accessible over the web'. To achieve your end goal below is what you will have to do:

1) Set 'Private file system path' to sites/default/private at Configuration > Media > File System. Create a directory called 'private' at sites/default on your server.
2) Add File field type to an existing or new content type. Under 'Field Settings' tab select 'Private files'. Populate the other fields under 'Edit' tab and save.
3) Go to People > Permission. Under 'File entity' there are few private file permissions. Check them for the role who ought to have access to private files and save.

With the above configuration your node will be visible to anonymous users but the files attached to those nodes will only be accessibly by the desired roles. A third party module is not required.

JonathonCarlyon’s picture

JonathonCarlyon commented

People > Permission there is no File Entity category. The only thing related to files I'm seeing is:

File
Access the Files overview page
- Get an overview of all files.

Also for clarification regarding the private file path, why do I see sites/default/private referenced (that's how it is in the docs too I believe) when they say it's better to house the files outside of the drupal directory? That's within Drupal and accessible over web isn't it?

RWill’s picture

RWill commented

Install File entity and ctools (required for File entity).

It's ideal to create the private directory outside the document root and can be done by setting the path at admin > config > media > file-system. Storing private files under sites/default/private is just another option. It is not accessible over the web because when you specify the path at admin > config > media > file-system it automatically adds a .htaccess file with Deny from all. This prevents Apache from serving files from sites/default/private.

Anonymous’s picture

Anonymous (not verified) commented

I've installed File Entity, gone to permissions and set so that anonymous users cannot view private files.
I create a content type that has an file upload field. I install Content Access module and make that content type inaccessible to anonymous users.
Create new node and upload a file to the private file folder. The file then has a url like http://localhost/MySite/system/files/uploadedfiles/UploadedFile.jpg and is clearly visible in the private folder that I defined in Admin-Config-Media.
UploadedFile.jpg is accessible to anybody, including anonymous users, with that URL, so long as the node exists.
This happens to me using Drupal 7 on a local WAMP server, and on Drupal 8 on a public server.

schiavone’s picture

schiavone commented

Seeing the same thing across a bunch of sites. Kind of shocked that this is a thing. Looking into some solutions including contrib modules.

sprite’s picture

sprite commented

Don't be afraid to use contributed modules.

Contributed modules are an important, even essential, aspect of Drupal.

Below, I've detailed the modules you need to implement what you want to do.

spritefully yours
Technical assistance provided to the Drupal community on my own time ...
Thank yous appreciated ...

arulraj’s picture

arulraj commented

hook_file_download_access will help you restrict the file download for anonymous users.

The hook is typically implemented to limit access based on the entity the file is referenced, e.g., only users with access to a node should be allowed to download files attached to that node.

khurrami’s picture

khurrami commented

This worked for me
1) at admin/config/media/file-system set as follow
Private file system path: sites/default/private
Default download method: Private local files served by Drupal.
2) in your content type's file field also set field settings
Upload destination: Private files
3) Check in your domain configuration file as follow
http://stackoverflow.com/questions/5210820/apache-server-ignores-htaccess
change AllowOverride None > AllowOverride All

AllowOverride All

sprite’s picture

sprite commented

1) setup private file system associated with file/media entities.
the private file system should be outside of the public_html hierarchy.
Place the private file system at a file server location like:

home/{user}/{webprivatefiles}/{website}/
- where the {*} components are variable names you define.

There are file, audio, etc. modules that create such entities.

https://www.drupal.org/project/file_entity

https://www.drupal.org/project/audiofield
- (you'll also want the patched version of the soundmanager2 module supporting the bar_ui player )

2) Use the Content Access module to restrict access to the node(s) that contain the private files/media.

https://www.drupal.org/project/content_access

3) Use Token Content Access Node module if you want to private "one off" URLs to the private nodes that you can regenerate later.

https://www.drupal.org/project/tca

spritefully yours
Technical assistance provided to the Drupal community on my own time ...
Thank yous appreciated ...

Anonymous’s picture

Anonymous (not verified) commented

.