I am having problem with the attached files that belong to a particular content node. Let's say if I made a content node viewable only by a group, I still see the attached files of that node globally viewable including guests via the absolute URLs (.../files/filexxx). How could I enforce the attachments have the same permission as the content node itself?

Comments

jjeff’s picture

jjeff commented
Status: Active » Fixed

In order to manage access to attached files, you need to move your file directory out of the web directory and enable the "Private" download method in admin/settings. There are more instructions about 'private' file downloads on the Drupal settings page.

Good luck!

samloo’s picture

samloo commented

I understand "private download" method but this is not sufficient. What "private download" enables is to prevent you from using direct URLs to access the the attachements directly but it does not offer protection for different users. As a matter of fact, even with private dowload enabled, all file attachments can still be accessed from a guest user regardless what access permissions you assign to the containing content node!

jjeff’s picture

jjeff commented
Status: Fixed » Closed (won't fix)

Well if that is the case, then "private download" is not really private is it?

However Simple Access only manages the existing Drupal node permissions. If you're having a problem with the way that private file downloads are working (or not working), then you're going to need to post this as an issue with the Drupal core.

It is outside the scope of Simple Access to handle file privacy if it not something that Drupal is handling already.