Commons Documents are private but the attachments are not [#2137017]

In my Commons 3.3 site, Group X is private and only members can view content. But when someone posts a document to Group X, the attachments are visible to anyone who can guess the URL.

There are a few angles to this I'm wondering about:

Support request:I'm reading Document how to install Commons so that files can be made private and that is not helping me. Attachments continue to upload into my sites/default/files folder where anyone can see them. Please help! Advice much appreciated.
Enhancement / bug fix:If I make a group with hidden content, Commons should warn me if my site is not configured to hide attachments from public view. Even better, Commons should make it really easy for me to configure files correctly, after it warns me that files are configured inconsistently with my desired level of group content access.

thanks for help with this

Comments

Comment #1

WebSinPat CreditAttribution: WebSinPat commented 24 December 2013 at 02:59

I'm interested in these questions as well.
(that document linked to in the OP seems quite old and I think refers to D6, so I dunno how applicable any of it might be, even if i could understand it and felt like trying all the different things suggested there. (which I don't))

One thing I'd been wondering how to do is to have files stored into the file system based on gid, rather than having everything just piled into sites/default/files
something like
files/groups/123
files/groups/345

I can set up my file manager to put uploads into files/groups/ but I'm not sure how to make it more fine grained based on gid.

Not sure if that would help with this issue in any case.

Comment #2

behoppe333 CreditAttribution: behoppe333 commented 2 January 2014 at 15:32

Hi @WebSinPat

I figured out the support question from my original post. (IMO the enhancement/bug fix question of my original post remains open.)

To the support question: My key step to enable private attachments was to go to Administration » Structure » Content types » Document » Manage fields » File. From there set "Upload Destination" to "Private."

If your site already has instances of the Document content type, then you have to delete those before you can edit the underlying content type and make the necessary change. Luckily I only had a few documents to delete and republish.

Warning: I am not sure if editing the Document content type as I suggest complicates/breaks the Drupal Commons upgrade process. There is a thread about customizing Commons and how that affects upgrades at https://drupal.org/node/2065381