The Situation

I am attempting to set up a Drupal site with a mixed private/public file system. I only want to password-protect (by role) certain files; the rest (css, most images, etc.) can stay public. The reason I don't just set the file system as stricly private is a performance one (for those who aren't familiar, using the private file system introduces a significant performance hit).

I have tried to implement the solution found here: http://drupal.org/node/189239
The differences between the situation described in the post above and my situation are that a) I am using FCKeditor to upload files instead of CCK w/ filefield and b) I am using Drupal 6 instead of Drupal 5.

In a nutshell the solution I am working on is this: to restrict the access to a folder I automatically redirect all requests to sites/default/files/file/private/xxx to /system/files/file/xxxx and handle the security in Drupal.

Step-By-Step

Note: FCKeditor handles different types of uploads (files, images, flash etc.) by putting them into subdirectories of the main files folder…this is what FILE_TYPE refers to below.

1) Set the file system to public. Files are accessible by /files/xxxxxx. But they are also accessible by /system/files/xxxxxx (this trick is key to the solution)
2) Create a folder in /files/FILE_TYPE/. For example: /files/FILE_TYPE/private/
3) Create a .htaccess file in the folder /files/ FILE_TYPE/private to do the automatic redirect to /system/files/FILE_TYPE/private (the one below is customized for the image file type)

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
Options +FollowSymLinks

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteBase /system/files/image/private
RewriteRule ^(.*)$ $1 [L,R=301]
</IfModule>

4) Now every request to a file in /files/image/private will be redirect to /system/files/image/private/. Note, only files within /private are affected by this setting
5) Create a module, activate it etc. containing (once again, customized for FCKeditor):

function private_files_perm() {
  return array('access private files');
}

function private_files_menu() {
  $items = array();  
  
  $items['system/files/image/private'] = array(
    'title' => 'Private images',
    'access callback' => 'user_access',
    'access arguments' => array('access private files'),
    'type' => MENU_CALLBACK,
  );
  return $items;
}

6) Enable access for the appropriate roles in the permissions section

The Problem

Now that I have done all of this, whenever I upload an image into the private images folder via FCKeditor it is not accessible to anyone, no matter the role. It seems to be locked out completely!

So, I tried changing one of the path entries in the module to this:

>
$items['system/files/image/private'] = array(
    'title' => 'Private images',
    'access callback' => TRUE,
    'type' => MENU_CALLBACK,
  );

With that, I was trying to make sure I wasn't doing anything wrong with the new menu system in Drupal 6, but still no luck! Could it be something else in my module code or the way FCKeditor interacts with Drupal that is causing the problem?

Thanks for any help!

Comments

tebb’s picture

Hi DM,

That's a clear explanation of the issue and it's one that I expect to have soon.

Did you solve it or find a way round it?