Hello,
I'm using node privacy byrole.module to make a couple of nodes only available for authenticated users. Anonymous user shouldn't have access to this nodes.
Furthermore I've enabled attachment.module and filemanager.module instead of upload.module.
admin/settings (only important settings):
- Clean Urls: enabled
- Cache support: disabled
- File system path: files
- Temporary directory: /tmp
- Download method: Private
admin/settings/filemanager (only important settings):
All directories are created (chmod: 755).
I'm testing at a fresh installation of Drupal (4.6.3.).
If I attach a file to a node which is only available for authenticated users, the links has the schema (# = node id):
http://domain.com/files_public/active/#/file.ext
The problem: Though anonymous users can't look at the protected node, they have access to the attached files, if the users know the direct link.
Does anybody knows how to protect attachments in protected nodes??
With the help of upload.module this is possible:
The link looks likes http://domain.com/system/files?file=file.ext
and by restricting the access to the physical directory "files" (chmod: 700), the file is only available for certain users.