Based on:
1) filefield_file_download takes care of access control; filefield_private doesn't need to it, it just needs to get the file to a path where file_download functions will be called
2) There already support for content distribution in filefield_file_download, though while it's not same control, it should likely suffice (I prefer it over filefield private, since a single filefield may have both attachment -- .txt and inline -- jpg and filefield's detects that). Also, current support results in Content-Disposition being set twice, which seems like a generally bad idea.
3) file_create_url prevents a filepath that it outside of the file directory. However, dynamic urls inside the file directory are possible, as can be seen via imagecache's hook_menu.
So the patch.
* Removes the custom page callback -- Uses a new path that is inside of the files directory that calls file_download like system/files does ((3) is why can't use system/files)
* Removes content distribution support due to (1) and couldn't figure out a smooth way to support it.
* Removes hook_nodeapi and the theme function and instead uses hook_file_load to change the filepath to one the new path will work with. As far as I can tell, hook_file_load is triggered before displaying the file (in node and views views), so should fix issues like #874684: URL of a Private FileField using Views or Panels.
I may be missing some reason why this approach has issues, but generally seems to work without problems.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | 1153448_filefield_private_simplify.patch | 8.48 KB | hefox |
| filefield_private_simplify.patch | 7.92 KB | hefox |
Comments
Comment #1
hefox commentedOkay so it didn't quite work with the directory outside of file directory, but a wrap around file_download that sets the variable fixes that.
Comment #2
hefox commentedCommitted to 2.x branch