Private File Access

I am also hoping that the file system is set to private so that I can use this module

Actually, the banner.module kinda works with private files. The problem is, that to make the file cache handler work, the current file system path is passed to the script. I'm not sure that is ideal.

One solution is to require that banner can get write access to a sub folder of the site root (e.g. <drupalroot>/cache). That way we can get around passing paths around which are currently only neede by the file cache handler.

If nobody as any major objections, I think adding a specific dir for the banner cache is an acceptable solution.

wulff,
Can you please tell us when you plan to implement your solution and if you dont mind can you please also elaborate what should be done for using banner module with the private file system.

Manuj

Banner.module isn't really guilty here. There are a lot more modules that do not work with private file access. If you need a quick workaround for a new site then setup your site with public file access and add a .htaccess file containing

SetHandler This_is_a_Drupal_security_line_do_not_remove
Deny from all

to the directory below /files containing your protected files, i.e. /files/protected or /files/store. If you're using E-Commerce file.module then you will find an separate option where files shall be stored in file settings. This way you'll have public file access to any files that are free (images and the like) and private file access to all protected, i.e. sold, files. Although file.module appends the real file path to the purchased file download link URL it won't be accessible by entering that file path directly.

If you already have a running site I badly suggest you to create a devel copy of it, change the global file handling, create some new protected files and have a look which files need to be moved and what needs to be changed to convert (fix) your productive site.

I really don't know where this issue should be properly discussed. I'll cross post at Groups for now.

>This way you'll have public file access to any files that are free (images and the like) and private file access to all protected

How would access be given to the private files (for authorised users) in this case (e.g. in files/protected)? The .htaccess files prevents Apache from serving them directly, which is what we want, but with access type as public Drupal doesn't serve them either and hence can't give let alone control access ...

Am I missing something?!

gpk

Every module supporting private file access has to support streaming of private files. Without streaming through a module url, file access wouldn't be possible if you had a "real private access directory" (such as ../../../files). So every module supporting private file access already implements a path based function to retrieve a file from private file storage.

However, I don't know if Banner module supports private file access. I don't think this would make sense... So banner files should always reside in a public accessible directory.

If you're implementing direct file access to private files within your templates, you should have a look at file.inc which should provide functions for retrieving files of a private/protected file storage. Your url will look then like this: www.example.com/somemodule/?fid=14. However, I don't think it makes sense to implement private file access without proper access permission handling by a module.

There is no way to grant only authenticated users access to private files. This is the job of the module providing access to private files. Anyhow, you could have a look at securesite module which allows dynamic .htaccess rules for your Drupal site, therefore allowing path access by user authentication.

Banner module supports private files (uploads are handled by the upload module, so this functionality comes for free).

The only problems is that the file-based cache handler needs the path to the files dir passed as a parameter to make it work. I'm working on a solution for that.

Yes - I second (or third) this: very important. Interestingly, even if I turn the cache off, I still don't get banners for anonymous users. Am I missing something simple - or is this part of the same issue?

Marking as closed since the banner module has been abandoned.