By pholm on

Hello,

I am configuring Drupal for use internally at my company. We need to be able to post files securely, so that only authenticated users can access them. I have installed the filemanager module and the attachment module. I have set administer->settings: download method=private, and have given appropriate private (drupal/private/project_1) and public (drupal/file/project_1) file directories inside my Drupal directory.

However, whenever I post a file as an attachment, it shows up in the public files directory (drupal/file/project_1). Then if I log out of Drupal and go to the url of that file (www.site.com/file/project_1/active/0/file.ext) I can access it freely. Am I doing something wrong, or is this a deficiency in the attachment module?

⋅ Categories: Drupal 4.6.x

Comments

iokevins’s picture

iokevins commented

pholm,

Yes, I am looking for a solution to this problem too. If one could associate a taxonomy with the attachment, everything could be controlled through taxonomy_access. But as it is, it is left to "security by obscurity." x_x

Your hopeful friend,

Kevin

"Extraordinary claims require extraordinary evidence"
-- Carl Sagan

arturoramos’s picture

arturoramos commented

There are a number of issues in the latest official release of the attachment module, but they have all been fixed...

The problem you mention is that the attachment module does not respect the privacy settings that are set in filemanager or in the access or taxonomy_access modules.

The first step is to force all attachments to be private. There is really no reason to have public files as everything, even the content that is accessible to anonymous users should be streamed through Drupal to keep track of the activity.

The following node talks about fixing this glitch:

http://drupal.org/node/25889

The next problem is that even if files are made private, there is no check to make sure that the node the files are attached to is accessible to the user... i.e. the node has been limited by access or taxonomy_access module but the attachment module does not check permissions before returning back a "TRUE" to the filemanager module when it checks for permissions...

This is discussed in the following node:

http://drupal.org/node/30468

and fixed in the patch attached to the following node:

http://drupal.org/node/44654

anner’s picture

anner commented

Is this fix for 4.6? I have the identical issues, but do not have an attachment.module...I have an upload.module. Should I change?