Hello,

Drupal 7 allows for public or private file storage. The latter is a misleading name, since the privacy refers to the storage, and not the files. To put it simply: if I upload a file using private storage, anyone in the world can still access it.

Certainly, module developers can hook into access in various ways, but the rest of us cannot. Access to uploaded files on a role basis was part of 6.x core, so the fact that it's missing now is, to me, a major oversight.

The documentation currently states that private file storage "allows restricted access to files within this field," which implies behavior similar to 6.x. Either the documentation should be rewritten to make this clear, or the behavior should be updated.

Now, it's possible that I'm simply overlooking something obvious about this. If so, I would love for someone to point it out to me. :)

Comments

zwhalen’s picture

zwhalen commented
Priority: Normal » Major
grendzy’s picture

grendzy commented
Status: Active » Closed (works as designed)

I'm not aware of any such functionality in 6.x core. Per-node and per-file access control has always been provided by contributed modules.
Overview of Node Access modules describes some options.

zwhalen’s picture

zwhalen commented
Priority: Major » Normal
Status: Closed (works as designed) » Active

Ah, I can be more specific. I'm not looking for per-node flexibility, since there are indeed ways to do that. I just want the on/off switch for files.

In drupal 6, upload.module creates two permissions: "upload files" and "view uploaded files". That's all I need in Drupal 7. As far as I can tell, it doesn't exist, since upload isn't around anymore.

grendzy’s picture

grendzy commented

I see what you mean. I'd forgotten about upload module.

DooDoo’s picture

DooDoo commented

I also looking for Role-based Access Control for Uploaded Files

hpbruna’s picture

hpbruna commented
Status: Active » Closed (works as designed)

Because the upload module is now part of the file module, you manage creating (upload) and viewing permissions with the http://drupal.org/project/field_permissions module.

NB: Files in private storage are not accessible with a normal link. People with no field-access cannot see the drupal generated link to the file. But if you share the drupal generated link to the file, also people with no access can access the file. But than again, if someone with access downloads the file, it can also be shared with anyone.