Access denied for file download when using private download method [#436802]

Hi,

I am attempting to make a protected biblio site that will have pdfs attached to the references. It is important that people are not able to get the files without being logged in, so I need to use the private download method.

If I set the download method to "private" I then will get "access denied" when clicking on a pdf attachment link of a biblio node (both summary & full view). It only does it for biblio nodes - I can download attachments off of posts without any problems.

The biblio attachments and post attachments are in the same directory, so I know it is not a directory issue. I have checked permissions. The path the links point to look correct.

Thanks!

Delphine

Comments

Comment #1

rjerome commented 17 April 2009 at 17:20

I tested this on my system, and I don't get the error you mention. Did you give the "view uploaded files" permission to the group you wish to have access to the files?

Ron.

Comment #2

rjerome commented 17 April 2009 at 17:22

Also, did you change the "Public" / "Private" settings after you uploaded/attached the files to the nodes? This can cause problems.

Ron.

Comment #3

pimousse98 commented 18 April 2009 at 16:13

I did change the setting after first uploading the files. I got it to work if, at one time, I delete the old file & re-upload it again. For some reason, if I delete the file, save and then upload the file again it won't work (maybe it needs to be a new file name?).
Many thanks for the hints :-). Would there be a way to avoid this problem? thankfully I am dealing with a small set of references so far. I can see this being a major problem with larger libraries. Also, it's strange how there was no obvious reason why it would not work (links were correct, etc) - I'm curious as to the mechanisms causing the "access denied" error.
Thanks again,
Delphine

Comment #4

rjerome commented 18 April 2009 at 17:50

Assuming you don't change that setting again, you shouldn't have any more problems. I think you may find clues as to why it doesn't work in the "files" database table. You could also look in the upload module to see what it's doing in terms of access control.

Ron.