By fannyd on

Hello,
I have some restricted nodes by role, and there are links to pdf files included in this node that only role allowed should access them. But if you write directly in you browser: http://mysite/sites/default/files/name_file.pdf, anonymous user can access it. How can solve this bug?
I have read about this that I should activate Download method Private , but if you have to complete Path File System , Will is not it happen the same?

⋅ Categories: Drupal 6.x

Comments

WorldFallz’s picture

WorldFallz commented

I don't usually recommend using the private file system setting because it makes all files private (including images) as well as has some module incompatibilities.

Some alternative methods:

I use the method outlined in the third bullet.

fannyd’s picture

fannyd commented

Hello,
First of all, sorry for my english...
My solution:

1) I create a .htaccess in the folder I want to protect:

SetEnvIfNoCase Referer "^http://mysite/" local_ref=1
<Files "*.pdf">
Order Allow,Deny
Allow from env=local_ref
</Files>

2) Important: This .htaccess must have the same permissions as the user that runs the apache.

3) Apache's configuration you must tell where is the new htaccess created:

<Directory /var/www/html/yourdomain/sites/default/files/>
AllowOverride All
</Directory>