A Flexinode's "file" field allows anybody to view and download files which were attached to an instance of a Flexinode content type.
This patch implements two bits of access control.
When a user is viewing the Flexinode node which contains a 'file' field, the Flexinode content-type access permission is checked before the URL to the file is even displayed in the node body.
When downloading the file via Drupals private files URL (), the flexinode_file_download() hook now checks what flexinode content-type is associated with the file, and then if the user actually has permissions to download the file.
Comments
Comment #1
buddaAttempt to re-post my flexinode patch
Comment #2
buddaFinally, attached the patch i hope.