I think the files attached to a node should respect the access rules applied to the node. Currently Attachments just provides files to anyone who asks for them.

CommentFileSizeAuthor
attachment.access.patch586 bytesstarbow

Comments

keve’s picture

keve commented

Regarding patch above:
$nid = db_result( db_query( "select nid from {attachment} where {attachment}.fid = %d", $file->fid ) );

Can it happen that a 'fid' belongs to more nodes?

ccourtne’s picture

ccourtne commented

No no through the attachments table.. Attachments are designed to belong to one and only one node. There have been requests in the past to allow sharing that would be a completley separate design and module.

keve’s picture

keve commented

Thanks.
+1 for above patch. I tested, it works fine for me.

ccourtne’s picture

ccourtne commented
Status: Needs review » Fixed

Applied. It will get checked in after me testing.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)