Problem/Motivation

Fresh install on Drupal 10.3.6, tested with the default Image field on the Article content type, and with a newly added simple File upload field there. Both could be downloaded by permissioned and non-permissioned user roles, even anons.

Not sure if this is a bug or it works as intended and we just need some documentation, like maybe having a private file system is a pre-requisite? 🤷🏻‍♂️

CommentFileSizeAuthor
#3 Screenshot 2024-10-17 at 11.27.19.png18.02 KBkopeboy

Comments

kopeboy created an issue. See original summary.

arunsahijpal’s picture

arunsahijpal commented

Hi @kopeboy,
If you configure private file system then also anonymous user is able to download the file.

kopeboy’s picture

kopeboy
Primary language Italian
Location Milan
commented
StatusFileSize
new Screenshot 2024-10-17 at 11.27.19.png18.02 KB

I think you didn't get my point.

Look at this permission:
file_download permission

If I don't enable that for authenticated users, I would expect them to NOT see the file download link, but that is not the case: they can see & download the image & file fields that use the formatter provided by this module.