Would it be possible to create a feature that would make files within nodes completely private? Currently you can access files within nodes if they're directly linked to.

Comments

Anonymous’s picture

Anonymous (not verified) commented

It can be done, but not terribly easily, but I did this before on my previous job. Essentially what I did was enable private file links (so that links go through drupal), then implement a module with a hook_file_download which queried the node id from the files table, then checked the access on that node for the current user and either allowed or denied the download.

I'll look at integrating this ability into the current module, it could be done as long as private URL's are enabled for file downloads and you're willing to take a bit of a hit on performance in downloading files ( you have the added overhead of a full drupal bootstrap for private URL's, plus the queries to check access control ).

mikgreen’s picture

mikgreen commented

Here's how it would look like:

/* nodeaccess for private files */
function site_file_download($filepath) {
	// which node does file belong to
	// which file record
	// which node
	$rez = db_fetch_object(db_query('SELECT * from {files} f JOIN {content_type_download} ctd ON ctd.field_file_download_fid=f.fid WHERE f.filepath LIKE "%'.check_plain(basename($filepath)).'"'));
	$node = node_load($rez->nid);
	
	// is node accesible?
	GLOBAL $user;
	
	$result = db_query('SELECT DISTINCT u.* FROM {users} u WHERE uid=%d', $user->uid);
  while ($data = db_fetch_object($result)) {
    $account = user_load(array('uid' => $data->uid));

		// echo theme('dna_permission',node_access('view', $node, $account));
    if (node_access('view', $node, $account)) {
  		if ($filemime = db_result(db_query('SELECT filemime FROM {files} WHERE filepath LIKE "%'.check_plain(basename($filepath))."'"))) {
	      return array('Content-type:' . $filemime);
			}
		} else {
			return -1;
		}
  }
}
Anonymous’s picture

Anonymous (not verified) commented
Status: Active » Closed (won't fix)