Using CCK fields with Private Download

@highrockmedia,

I just had the opportunity to use FileField Paths w/ Private Download and you're right the combination work wonderfully together.

Cheers,
John

i am trying to use cck file fields with this module and its not enforcing permissions. i dont know why you would need filefield paths tho bc cck by default lets you set the relative path for a file field.

i have a cck field with path private and my private directory is private and it has the .htaccess and everything but its not enforcing the permissions, it always lets me download the file.

i guess with file field paths i would be hiding what the real path is maybe but then since its a writable directory if someone figured out the real path is sites/default/files/private/path-to-file.pdf they could still get to it. what do i need to do to prevent getting access to the file via the back door?

ok nevermind - this whole time the problem i was having was i needed to reload in the browser. i think maybe it was caching the file. i would try to download the pdf as superuser, log out and attempt to download the file and it was letting me.

i think there was some browser cache stuff going on. if i reloaded the page, then tried to download the file the redirect would work and it would give me access denied.

ok so i have a question, i have a nice little tricky for making a file optionally private using filefield_paths.

a text cck field checkbox where the checked value is 'private'

And then in my file path path I have the token: [field_private_flag-raw] which will either be private or nothing. so far it works, the private directory is protected and the main directory isnt so i have the option per node to restrict access.

my question is, is there a security risk with the -raw token if only privileged users have access to edit this content? i dont see any other way of doing this.

I set my private folder to be called private. Then I went to CCK and made my path: private, just like in my private download settings.

I went to a page and uploaded a file. I saved a the node and tested. I got a file not found error. What am I doing wrong?
To be clear, this is what I am getting: The requested URL /system/files/private/xxxxxxxx.pdf was not found on this server.

Becky

Did you confirm the uploaded file is physically in the directory? Does the .haccess exist in the private directory?

Yes to both.

Attached is a screenshot of my settings.

That looks correct.

Hmm,, what's your private download settings look like?

Attached is a screenshot. For test purposes I'm running the module on my bitnami installation of drupal on my local hard drive. I thought maybe it was lacking a rewrite module but it's there...module_rewirte.so.

Becky

Attached is a screenshot. For test purposes I'm running the module on my bitnami installation of drupal on my local hard drive. I thought maybe it was lacking a rewrite module but it's there...module_rewirte.so.

Becky

Here is the screenshot.

Your settings look correct.

Honestly, that's all there is to it.

I assume you have clean URLs enabled (?)

Yup. Going to try installing it in a non local website today and test it out.

As far as documentation goes, this is incomplete. Can someone give an example of what capability the FieldField Path allows - beyond that which comes with CCK FileField - relative to allowing Private Download to serve as an upload module as well?

Also, beckyjohnson, did you ever figure this out? I'm having the same problem.

@highrockmedia - I'm fairly certain the FileField Module itself allows for that capability whereas FF Path allows for advanced operations on the path (e.g., token substitutions) but I suppose the outcome is the same. Just trying to clarify because I'm in the middle of one of those bash-your-head-against-drupal-until-you-figure-it-out sessions.

As I detail in the documentation post #967160: How to setup Private Download and use with CCK FileField, the FileField Path module is not needed to upload files into the sites/default/files/private directory. The CCK FileField module and its dependencies are all that is needed.

Bacteria Man, would you please correct this on the project page? Also, thanks for this module and the time you take to respond to issues. You're much more receptive than the average maintainer.

@kbk, you're absolutely right. CCK FileField is the only thing needed. Sure, I will update the project page. Thanks for bringing this to my attention. Also, thanks for the kind words.

John (aka. Bacteria Man)

Cool. I think we've gotten enough mileage out of this issue. Reopen if necessary.