I have a node that is in an OG Group, but it is Public, meaning that anonymous users can see it.

I attach a file to this node, and mark it Private.

Anonymous users do NOT have "view uploaded files" permission. So, they do not have access to download the Private file.

However, when an anonymous user views the Public node, he can *see* the Private file link.

1. Is that supposed to happen?
2. If so, is there a way to make the Private file NOT visible to the anonymous user if he does not have the "view uploaded files" permission?

Thanks for any assistance.

Comments

starbow’s picture

starbow commented
Status: Active » Closed (works as designed)

In this case the word "private" just means that the files respect the access rules of the node they are attached to. If the node is viewable by Anonymous uses, the files attached to that node will be as well.

Chill35’s picture

Chill35 commented
Component: Code » Documentation
Assigned: Unassigned » Chill35
Category: support » bug
Priority: Normal » Critical
Status: Closed (works as designed) » Active

You must then change your project page to reflect this, starbow.

SomebodySysop says:

Anonymous users do NOT have "view uploaded files" permission. So, they do not have access to download the Private file. However, when an anonymous user views the Public node, he can *see* the Private file link.

The project page says:

[...] the user must have "view uploaded files" permission, and permission to view the node that the file is attached to.

starbow’s picture

starbow commented
Status: Active » Postponed (maintainer needs more info)

Looking at this one again, I am confused. Is the issue that the anonymous user can see the link to the file, or can they actually view the file itself. If they can view the file, that is a bug. If they can just view the link, but clicking it does not actually open the file, then the module is working as designed.

somebodysysop’s picture

somebodysysop commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)

I guess that was my question. I just thought that if the user didn't have access to the content, he shouldn't see the link period. But, if that's the way it works, that's the way it works.

starbow’s picture

starbow commented
Status: Closed (works as designed) » Fixed

This came up again when I was re-evaluating the code for the port to D6, and I have realized that you are right. The file attachments table should not be shown to users without the 'view_upload_attachments' permission. More generally, I have modified the rules in RC2 so the attachments table is shown only when the core upload module thinks it should be shown.

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.