Restrict specific folders from public download (via .htaccess)

If you set "public" as the download method, you can still protect some of your folders by settings in your .htaccess file, if you have mod_rewrite enabled.

For instance, if your files live in sites/default/files, and you want to protect everything in sites/default/files/protected_download_dir, then you can add the following line to your central .htaccess file:

RewriteRule ^sites\/default\/files\/(protected_download_dir\/.*)$ index.php?q=system/files/$1

The files in this folder (or, all files that match the regular expression) will not be served directly by apache, but by a full drupal request using the file_download() callback. The routing for system/files is defined in system_menu().

.htaccess troubleshooting

There are some pitfalls when writing the htaccess file: you need to write correct regex syntax, you need linebreaks between different rules, you might need specific RewriteCond statements with each rule, you need the correct apache configuration, etc.

If you have something to share about your htaccess configuration, please do so!

Access Checking for File Downloads

Modules can do access checking on files downloaded through file_download(), by implementing hook_file_download().

For instance, the filefield module will do access checking for all files that you upload via filefield. It will only give access to people who are allowed to see the node and the field the file belongs to.

In addition, you can look for modules that restrict file downloads based on the folder name or other criteria.

Access Checking built-in with Filefield

The filefield module has access checking built-in. To make use of this, please

1. Make sure to use the latest dev version of filefield (for now). The current offical release (08/2009) has a bug in access checking. Have a look into filefield issue 516104.
2. Configure the filefield you want to protect. Use the filefield path module, to define where the files for the filefield should be stored by default.
3. Add a line to your .htaccess to protect this folder (see above).
4. Use whatever modules to restrict node or field access.

Files Attached to Nodes

If you want to protect files uploaded with the core upload module, have a look at the Private Upload module.

Folder-specific Permissions

As an alternative, you can restrict folder access based on the Drupal permission system, introducing one permission per folder. Have a look at

• http://www.drupalcoder.com/story/406-mixing-private-and-public-downloads...
• The private_download module, which is an implementation of the article above.

Typical Slip-Through Candidates

If you want to protect your files, you should think of the following situations where a file might remain unprotected:

• Thumbnail images (for instance, those generated with imagecache or imagefield) typically live in a different directory than the original. If you want to protect these as well, you need to add new rules to your .htaccess file. You might even have to install additional modules for the access checking.
• Import directories. If you use an importer to add your files, it can happen that a copy of the file is still in the import directory. Solution is to either manually clean up the import directory (via FTP), or to protect it (using a .htaccess rule).
• Orphan files. Sometimes when you delete a node with a filefield, the file will still be there, but it will no longer be associated with any filefield node. This can happen if your filesystem permissions don't allow deleting files. As a consequence, filefield's access checking will no longer apply to this file. You need to find (or code) a new module to protect these files, or you have to clean up manually.