I am posting this after spending several hours tweaking my setting and searching the internet/drupal for help.
Is there a way to make webform upload directory sites/default/files/webform private.
What I wish to achieve is that all the files uploaded (via file component) by people submitting the form be private and only accessible through drupal. In order to view and download the file submitted by users the staff member have to do the following
login and visit the submissions page
click on the file name/link to initiate the download.
I tried setting the directory sites/default/files/webform as private in admin/config/media/file-system. This places an .htaccess file in directory with "Deny from all" directive.
Now after making a test submission when I go to the submission page and try to download the file by clicking the link It give the following error:
Forbidden
You do not have permission to access this document.
The above error is otherwise normally expected when one places a .htaccess with Deny from all directive. However, I am getting this error even when I have already set sites/default/files/webform as private in drupal file system. Shouldn't drupal create internal links. I am unable to click and download the files even when logged in as user1. How to make webform uploads downloadable only from within drupal and by privileged logged in users.
Any help will be greatly appreciated.
| Comment | File | Size | Author |
|---|---|---|---|
| #13 | support-private-file-fields-in-drupal-7-1054616-13.patch | 3.52 KB | kerasai |
Comments
Comment #1
keiichito commentedI want/need this feature too.
I'm using webform and, and It would be nice if the webform upload directory could be outside of the Webroot, could be set from the drupal file system or use the same local file system path.
Is there a way this could be implemented?
Comment #2
quicksketchYes this is possible to implement in Drupal 7, but no, it is not yet implemented. It is not possible in Drupal 6 (at least in a way that Webform module would provide support). This feature will be a natural side-effect of revising our file component in #289919: Provide AJAX-based file uploads/Progress Bar for uploads, since the managed-file field type naturally supports both private and public files.
Comment #3
keiichito commentedMeanwhile there's a way a can edit the default path manually where webform upload the files?
Comment #4
quicksketchPlease do not raise new questions in a single issue. See #326738: Support tokens in the File Upload Directory field.
Comment #5
quicksketchSorry that last post I misunderstood as requesting a sub-directory path, not an entirely different path than the public path that Webform supports.
Changing this thread to be the official feature request for private file support.
Comment #6
henryblyth commentedSubscribing. This would be very, very useful.
At the very base level, it would be great for the Webform File component to be closer to Drupal's File field. By that I mean the user has access to the Public or Private file system options underneath the file field.
Comment #7
jmcneil commentedSubscribing, very important feature, getting around this by placing in a .htaccess file with BasicAuth so that administrators can access the files.
Comment #8
ret5 commentedSubscribing also. Running into the same issue using the .htaccess method and not being able to access the resulting upload.
Comment #9
agoradesign commentedsubscribe
Comment #10
blauerberg commentedsubscribe
Comment #11
highmastdon commentedComment #12
highmastdon commented+1 subscribe
Comment #13
kerasai commentedPlease see the patch and let me know if it works for you. This adds a download method configuration to the form item. I've run it through some simple use cases and it seems to be working well for me.
Comment #14
quicksketchPlease use the "Follow" button at the top of the page instead of "Subscribe" comments.
@bmoresafety20: I'd really prefer to implement #289919: Provide AJAX-based file uploads/Progress Bar for uploads and switch to using the #type = 'managed_file' element available in Drupal 7, which would also solve this problem.
Comment #15
quicksketchThere's now a patch in #289919: Provide AJAX-based file uploads/Progress Bar for uploads that adds full private file support in Drupal 7. You can even mix private and public file components within the same form.
Comment #16
ditcheva commentedI've updated to the latest release, but do not see how this adds 'private file support' to webform form file components. If it's not too much trouble, quicksketch, could you be more specific on how that's accomplished with the ticket you've linked to.
I notice in one of your comments that it says the new version will include a 'managed_file' upload element... is that supposed to be a new form component type that should be popping up in the form component type list or is this functionality occurring some other way? Any clarification would be very much appreciated!
Thanks,
Boriana
Comment #17
ditcheva commentedHere is what I have tried so far:
Using webform 3.16, which I think implements the new patch (based on the release notes), I made a file field component and have it store corresponding files in /webform/private (which is what I've designated as my system's private file directory). However, it does not behave as I'd expect. When logged in as admin, and viewing submissions with such file uploads, the files uploaded to that directory via the webform interface are not even viewable by admin. I know files in the private files directory should not be viewable through direct links, but they should be when accessed through a drupal file link. It doesn't seem that the file links in the submission view act that way.
Am I misunderstanding how the patch solves the private files issue with webforms? Has anybody else implemented a successful solution they can share?
Comment #18
quicksketchThere's a bug in 3.16: #1460266: Typo in webform_file_download prevents users from downloading private files. It will be included in a follow-up official release (3.17) shortly.
Comment #19
drupalninja99 commentedI am still having this issue with 3.19. I get a 404 error even though I know the file has been uploaded correctly.