No restriction over files added to a protected node [#68220]

There´s no restriction to file´s added to those nodes that are protected.
If I create a taxonomy that is available only for registered users and create a node under that category and add a file using the upload.module, the uploaded file is available for anonymous users.

Is there a way for Tac_lite to prevent that?
If the answer is that it´s not possible (hope not), any idea of how can I do that?

Thanks in advance!!!!!!!

Rosamunda

Comments

Comment #1

Rosamunda commented 9 June 2006 at 18:48

... maybe this could work with the upload module...

Comment #2

Dave Cohen commented 13 June 2006 at 16:22

Status:

Active

» Fixed

Remember that to have drupal enforce any sort of control over file downloads, you have to set the file handling to 'private' under admin/settings.

Beyond that, upload.module has a very simple permission scheme. Either you have permission to download all files, or none. There's nothing tac_lite can do about that. Submit a feature request to the upload module.

-Dave

Comment #3

silurius commented 16 June 2006 at 01:03

I just came to the same realization as I was setting this up. My customer needs to sell members unique files, each tailored specifically for a specific user. With Search turned off, and with links to the tac_lite-secured node being sent directly to the users, how easy would it be for an anonymous user to locate files they are not supposed to be privy to?

Comment #4

silurius commented 16 June 2006 at 01:07

With Search turned off, and with links to the tac_lite-secured node being sent directly to the users, how easy would it be for an anonymous user to locate files they are not supposed to be privy to?

I just realized that with fairly unique file names, there probably is no simple way for folks to locate files in this scenario, without actually knowing the file name. Is this true or am I missing something. If it is true, does anyone know of a nice freebie for creating a unique alpha-numeric code, which I might consider using in my filenames?

Comment #5

Rosamunda commented 16 June 2006 at 02:09

Both of you´re right.
It is not something that tac_lite should care about, it is for some sort of upload/attachment/filemanager module.

[Answering to silurius]: I think the principal security issue is that somebody can get the file through Google...

But I´ve found that attachment module can handle this :-)

Thanks!

Rosamunda

Comment #6

Dave Cohen commented 16 June 2006 at 19:14

If you show a link to the file only to users with permission, then google would theoretically not index the file.

However, if you rely on an obscure URL for file security, nothing prevents a user with permission from emailing the URL to all his friends. Not a good idea.

Drupal's default file handling comes up short for many people. And there are many threads out there discussing alternatives.