Can access private files with any user by going directly to the URL [#869240]

I uploaded some files as "private" to a user profile on a website I am building.

I assumed that because I set the files as private, that only the user whos profile it was uploaded to would have access to the file.

I copied the URL, I logged out, logged back in as a different user, pasted the URL and I was able to view the file.

How is this private if any logged in user can view the file if they know the URL?

Doesn't seem very secure.

I need this setup so only the intended user can view the file. Is this possible?

Please help.

Comments

videodoll commented 30 July 2010 at 05:11

Version:

6.x-1.x-dev

» 6.x-1.0-rc2

burningdog commented 1 September 2010 at 21:49

Status:

Active

» Closed (works as designed)

You *should* get an Access Denied page if you try to download the file directly, unless the user you're logged in as has permission to view the node.

From the documentation at the top of the module file:

 * Definition of private: If a user has permission to view the node, they can 
 *  download the attached private file.