Add "private" checkbox on Comment Upload attachments to comments

Changing from bug to feature request.

+1

+1 this would be an important addition to a great module. Thanks!

Drupal 6:
I made all files attached to comments (Comment Upload module) private by using doing this:

function private_upload_file_download($file) {
  $private_dir = variable_get('private_upload_path', 'private');
  if (_private_upload_starts_with($file, $private_dir)) {      
    $filepath = file_create_path($file);
    $result = db_query("SELECT DISTINCT(u.nid) FROM {upload} u INNER JOIN {files} f ON u.fid = f.fid ".
                       "WHERE f.filepath = '%s'", $filepath);
    while ($row = db_fetch_array($result)) {
      $node = node_load($row['nid']);
      if (node_access('view', $node)) {
        return; // Access is ok as far as we are concerned.
      }
    }
    //new stuff is below: access not granted by node, let's see if it's attached to any comments on nodes the user has access to
    if(function_exists("comment_upload_nodeapi")){
        $result = db_query("SELECT DISTINCT(u.nid) FROM {comment_upload} u INNER JOIN {files} f ON u.fid = f.fid ".
                           "WHERE f.filepath = '%s'", $filepath);
        while ($row = db_fetch_array($result)) {
          $node = node_load($row['nid']);
          if (node_access('view', $node)) {
            return; // Access is ok as far as we are concerned.
          }
        }    
    }
    
    return -1; // No nodes are granting access, so veto download.
  }
}

and then added this hook in a custom module

//implementation of hook_comment
function mymodule_comment(&$a1, $op){
    
    if($op == 'validate'){
        //all this stuff is copied from private_upload_nodeapi() and $node replaced by $a1
        if (is_array($a1["files"])) {
          foreach ($a1["files"] as $fid => $file) {
            $file = (object)$file;  // Convert file to object for compatibility
            $fid = $file->fid; // for the cases where we have temp fid for uploaded files
            $success = FALSE;
            $filepath = $file->filepath; // need copy if file_move fails.
            // save original name
            $filepath_orig = $filepath;
            $public = file_directory_path();
            $private_path = _private_upload_path(); // actual path of private files
            $file_is_private = _private_upload_is_file_private($filepath);
            if (!$file_is_private) { 
              // private flag is set, but file NOT yet listed as being in private repo,
              //   so try and move it from public area to private repo
              if (file_move($filepath, $private_path, FILE_EXISTS_RENAME)) {
                // check whether the file was renamed
                if ($filepath_orig != $filepath) {
                  // update the filename in the object if so
                  $file->filename = basename($filepath);
                  $file->filepath = $filepath;
                }
                $success = TRUE;          
              }
              else {
                drupal_set_message( "Could not move the file ($file->filepath) to the private directory ($private_path).", 'error' );
              }                          
            }
            
            if ($success) { // we were able to move the file, so update filepath in db.
              _private_upload_update_filepath($file);
              $row_count = db_affected_rows();
              if ($row_count != 1) {
                drupal_set_message( "Error: Unable to make uploaded file private! (". $row_count .")", 'error'  );
              }
            }
          } // Done with all the files.
        } 
    }
}

NB this code assumes that comment files are always private, there is no option to have them public. If the node that the comment is in reply to is public then the attachment might be, I haven't tried that out though.

Thanks, rimu. Your solution works great.

Thanks rimu, your solution works, but note/heads up for people using it, your comment's attachment download link will still be pointing directly to the actual file, and not the 'private' file system as it should. I had to add another section to the above hook_comment() on rimu's post checking $op == 'view', implement a preprocessor for theme_comment_upload_attachments, and also had to hack comment_upload module a bit :(

If anyone has a better solution please share.

/**
 * Implementation of hook_comment
 */
function HOOK_comment(&$a1, $op){
  switch($op) {
    case 'validate':
      //all this stuff is copied from private_upload_nodeapi() and $node replaced by $a1
      if (is_array($a1["files"])) {
        foreach ($a1["files"] as $fid => $file) {
          $file = (object)$file;  // Convert file to object for compatibility
          $fid = $file->fid; // for the cases where we have temp fid for uploaded files
          $success = FALSE;
          $filepath = $file->filepath; // need copy if file_move fails.
          // save original name
          $filepath_orig = $filepath;
          $public = file_directory_path();
          $private_path = _private_upload_path(); // actual path of private files
          $file_is_private = _private_upload_is_file_private($filepath);
          if (!$file_is_private) { 
            // private flag is set, but file NOT yet listed as being in private repo,
            //   so try and move it from public area to private repo
            if (file_move($filepath, $private_path, FILE_EXISTS_RENAME)) {
              // check whether the file was renamed
              if ($filepath_orig != $filepath) {
                // update the filename in the object if so
                $file->filename = basename($filepath);
                $file->filepath = $filepath;
              }
              $success = TRUE;          
            }
            else {
              drupal_set_message( "Could not move the file ($file->filepath) to the private directory ($private_path).", 'error' );
            }                          
          }
            
          if ($success) { // we were able to move the file, so update filepath in db.
            _private_upload_update_filepath($file);
            $row_count = db_affected_rows();
            if ($row_count != 1) {
              drupal_set_message( "Error: Unable to make uploaded file private! (". $row_count .")", 'error'  );
            }
          }
        } // endforeach
      } // endif
      break;
    case 'view':
      if($a1->files) {
        foreach($a1->files as &$file) {
          $file['filepath'] = _private_upload_create_url((object) $file);
        }
        $node = node_load($comment->nid);

        $display_setting = variable_get('comment_upload_images_'. $node->type, 'none');
  
        if ($display_setting != 'none') {
          $display_images = TRUE;
          if (is_numeric($display_setting)) {
            $imagecache_preset = imagecache_preset($display_setting);
            $preset_name = $imagecache_preset['presetname'];
          }
        }
        
        $a1->comment .= theme('comment_upload_attachments', $a1->files, $display_images, $preset_name);
      }
      break;
  } // endswitch
}

function HOOK_preprocess_comment_upload_attachments(&$variables) {
  $row = 0;
  $variables['images'] = array();
  $variables['attachments'] = array();
  foreach ($variables['files'] as $fid => $file) {
    if ($file['list'] && empty($file['remove'])) {
      $text = $file['description'] ? $file['description'] : $file['filename'];

      if ($variables['display_images'] && strpos($file['filemime'], 'image/') === 0) {
        if ($variables['preset']) {
          $variables['images'][$fid]['image'] = theme('imagecache', $variables['preset'], file_create_path($file['filepath']), $text, $text);
        }
        else {
          $variables['images'][$fid]['image'] = theme('image', file_create_path($file['filepath']), $text, $text);
        }
        $variables['images'][$fid]['url'] = check_url(file_create_url($file['filepath']));
      }
      else {
        $variables['attachments'][$fid]['zebra'] = $row % 2 == 0 ? 'odd' : 'even';
        $variables['attachments'][$fid]['text'] = check_plain($text);
				// below line is the only difference from original
				// preprocessor in comment_upload.module
				// @see template_preprocess_comment_upload_attachments()
        $variables['attachments'][$fid]['url'] = url($file['filepath']);
        $variables['attachments'][$fid]['size'] = format_size($file['filesize']);
        $row++;
      }
    }
  }
}

and on comment_upload.module around line 399 in function comment_upload_comment_view comment out the line:

//$comment->comment .= theme('comment_upload_attachments', $files, $display_images, $preset_name);

otherwise you'll get 2 attachment tables