When the file download method is configured to private webfm managed files are always accessible. Since in this case .htaccess cannot be used to limit access and no other module blocks access WebFM should handle this by implementing the hook_file_download. The hook implementation could either just prevent (block) access or hanle the access just as in webfm_send.

Attached please find a patch that implements the hook. Access controls are the same as in webfm_send (it should be possible to move the shared code parts out of both functions so that changes to the access control code does not need to be duplicated.

CommentFileSizeAuthor
module-webfm-webfm_file_download-2.x-dev.patch3.32 KBfajo

Comments

cgmonroe’s picture

cgmonroe commented

I'm not clear on what problem you are trying to solve here?

AFAIK, to properly secure normal Drupal files, you need to do two things: 1) Set the mode to private; 2) move your file storage directory outside of your web server's html document area. If you don't do #2, the ALL files are still unsecure and accessible via direct URLs. (Well, you can use a .htaccess in the full directory to sort of do this...)

If you do this, then WebFM files should be as secure as if they are blocked with .htaccess. You can only get them via WebFM's interface and webfm_send method. So, I'm not sure why this hook needs to be implemented?

Am I misunderstanding something here?

FWIW - Setting all Drupal files to private is also a VERY big performance hit because every logo, avatar, etc has to be processed by Drupal. Also, you can't use any of the CSS, JS optimization settings... which can cause some versions of IE to break if you have more than 30 css files linked in (not uncommon for Drupal).

fajo’s picture

fajo commented
Category: bug » feature
Priority: Critical » Normal

The files are protected, you are right. The reasons why private files where accessible in my setup where:

  • I missed to "Disable serving of private files" in IMCE (for security reasons, the default should be "disabled")
  • I found a bug in Gallery Assist (the hook does not check if a file is registered whitin the "files" table)

I will open bug reports (if they do not exist already) for both issues.

I changed the Category to "feature request" and lowered the priority to "normal". Anyway, I would appreciate to have the ability to access files both ways (webfm_send and system/files). I will not harm. The only drawback with the patch provided is, that it does not update the download counter currently.

nhck’s picture

nhck commented
Status: Active » Closed (duplicate)

Fajo, thank you for taking the time to provide the patch. However I am already working on this since there have been multiple issues about this thats why I am marking this as a duplicate of: #591144: Implement hook_file_download. Also we need to keep in mind that duplicate code is not a solution to this matter. Please check the issue I referred too for a solution which I will post soon.

Again: thanks a lot for taking the time!

fajo’s picture

fajo commented

You are welcome - seems I have missed #591144: Implement hook_file_download because of the title was indicating an other issue.

lilon’s picture

lilon commented

subscribing