What about protecting attached files?
| Project: | Content Access |
| Version: | 6.x-1.1 |
| Component: | Code |
| Category: | task |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | active |
Jump to:
This module did what my site required in terms of restricting content to a certain role. However, I notice that any files I attach to that content are visible not only to authorized users without that role, but to anonymous users as well. Private Upload will remedy this to some extent, but it would seem intuitive that Content Access would align the permissions for an attachment with the permissions for the node it's attached to. I hope this can be added as a feature. If possible I'd also like to see an enhancement that would allow the admin control over access to directories (not just content per se). Private Upload protects only the default upload directory. On my site there are other directories whose files need to be unviewable except for certain roles.
#1
>it would seem intuitive that Content Access would align the permissions for an attachment with the permissions for the node it's attached
to
It's already that way as soon as you enable private file downloads.
#2
Not for me. When I attach a file to content that only a particular role can view, then log out, I can open that file just by pasting its URL in the browser. I can also open it if I log in as a different user.
#3
I have the same issue. I am happy to look at the code, if you (fago) think it can be added/fixed in the module. I would prefer not having to manage file issues somewhere else, as Content Access keeps everything clean.
#4
I am looking for the same exact feature.
Would like to attach a video flv file to the node and let only authorized users access them (view it in a flash player module like flashvideo). I am concerned that users could bypass this and go straight for the file.
I notice there is a lightweight module for this that uses htaccess like http://drupal.org/project/downld which is super simple with 5 lines of code.
#5
Has this bug been fixed? I see an even different behaviour, if I attach a file to a content type that I restricted to a certain role then:
- the unauthorized users can still access the attachment via url
- the authorized user *can not* see the attachment in the site
- administrator (or users in administrator group) can see the page and the attach shows up
that is, the file is there for everybody but it doesn't show in the page as an attachment.
#6
Well it depends on the module caring for the file upload - it has to respect node access. If it doesn't, content access has no chance to deal with it. If it does, it should already work.