Hi I have sites installed using aegir, so all the sites are in this structure:
/sites/site1.mydomain.tld/files/private
/sites/site2.mydomain.tld/files/private
/sites/site3.mydomain.tld/files/private

I do get access denied if browsing to the URL: site1.mydomain.tld/system/files/private when logged in without the download permission.
But roles without permission to download the file are able to download them through site1.mydomain.tld/sites/site1.mydomain.tld/files/private

Helps are appreciated, thank you.

Comments

lukus’s picture

lukus
he/him
commented

Have you had any luck working out whether it's possible to use this module with Aegir? I'm currently trying to attempt the same as you. Any advice appreciated.

Cheers,

Luke

johnhanley’s picture

johnhanley commented

I've never tried using Private Download in a mult-site configuration, but you might try the following:

/sites/default/files/private/site1
/sites/default/files/private/site2
/sites/default/files/private/site3

The .htaccess should provide protection for each sub-directory, but it's possible each one will need to contain a separate .htaccess file.

In any event, please report back with your findings.

johnhanley’s picture

johnhanley commented
Category: bug » support

Switching the category to "support request" for now since this could be a simple configuration issue.

johnhanley’s picture

johnhanley commented
Priority: Critical » Normal
Status: Active » Closed (fixed)

Closing due to lack of response from original poster.

TimG1’s picture

TimG1 commented
Status: Closed (fixed) » Active

I'm experiencing the same issue. I'm on Aegir with multisite too.

www.example.com/system/files/private/Testfilename.txt URL correctly gets the Access Denied message.

However, I'm still able to access via www.example.com/sites/example.com/files/private/Testfilename.txt

I've tried to change the .htaccess content on the page /admin/settings/private_download however, everytime I try and save the form, I get an error that says: "The RewriteBase path does not equal /system/files/private in htaccess content."

So, I've gone directly into the .htaccess via FTP to try changing the .htaccess setting manually. I tried the following two settings with no luck...

  1. RewriteBase /sites/default/files/private/example.com
  2. RewriteBase /system/sites/example.com/files/private

On this page /admin/settings/file-system my file system path setting is "sites/example.com/files"

Any ideas?

Thanks for reading,
-Tim

leon85321’s picture

leon85321 commented

Finally got it work... sort of.... still need more test with the configuration.
It is not this module's fault, nor Aegir.
It is simply Apache's configuration

From here: http://drupal.org/node/906624
Then follow the post, I did a lot of research about AllowOverride All for apache stuff, then come out with this:

If you are using this module for specific site only:
Below this line "SetHandler This_is_a_Drupal_security_line_do_not_remove" in your /var/aegir/config/server_master/apache/vhost.d/[domain.tld] file, add

      AllowOverride All
      Order allow,deny
      allow from all

Then save, and I did restart my apache, not sure if it is needed, but I just thought it would be safer to do so.

If you are using the module for the whole Aegir multi sites, you can just add the following lines to /etc/apache2/apache2.conf somewhere below the "AccessFileName .htaccess"

<Directory "/var/aegir/">
  AllowOverride All
  Order allow,deny
  allow from all
</Directory>

Then save it, also do a restart on apache2 server.

Then after re-enable this module, set the filefield path to private/[folders]
Go to the /admin/settings/private_download and add more lines

  RewriteBase /system/files/private/[folders]

Then, most importantly, copy the .htaccess file from your /sites/[domain.tld]/files/private/ to all the [folders] you specified in the private_download setting, otherwise the rewrite won't pickup the settings (unless there is better way, I am newb for linux... )

This should work, it works for me...

Hope this helps, and maybe the maintainer can add the function to automatically produce the .htaccess files to all the folders specified in the RewriteBase line :)
And if can also add token in the configuration file would be awesome too since I do a lot of filefield path with [nid] or [title]...

Leon

johnhanley’s picture

johnhanley commented
Component: Code » Documentation

@leon85321, thanks for sharing your findings.

zeebo’s picture

zeebo commented

I'm about to try setting this up myself, but based on the the previous posts, still unclear on what directory structure would be best to use for private files in a multi-site installation. I need to set it up such that an authorized user on one site can't access any other site's files.

Would be interested to see if anyone has a recommended directory structure for this and which if any .htaccess mods should be made. thanks

zeebo’s picture

zeebo commented

Just wanted to say that I had no problems getting this module to work with multi-site. I just put my private folder in the site-specific files folder for each site, and make sure the .htaccess is redirecting to that site's system/files url and all works fine. You can only retrieve the private files for a site if you're logged into that specific site. Much thanks for this great module.

leon85321’s picture

leon85321 commented

Hi zeebo,

Thanks for your sharing, but did you try to type the URL manually? This is where my #0 post was really about.
e.g.
http://site1.com/sites/site1.com/files/private/[file-name] --> will allow you to pull that file if #6 is not applied.

zeebo’s picture

zeebo commented

Are you sure your .htaccess file in your private dir is running? If it is, then when you try to get:

http://site1.com/sites/site1.com/files/private/[file-name]

it should redirect you to:

http://site1.com/system/files/private/[file-name]

If that works then you shouldn't be able to retrieve the file if you're not logged in and have not given anonymous users the access_private_download_directory permission.

Note that I am running my multi-sites using the subdirectory not subdomain method.

So my sites are e.g.:

http://mydomain/site1
http://mydomain/site2
http://mydomain/site3

then the dir structure i have is:

/drupal-root/sites/mydomain.site1/files/private
/drupal-root/sites/mydomain.site2/files/private
/drupal-root/sites/mydomain.site3/files/private

The rewrite rule in the respective .htaccess files are:

RewriteBase /site1/system/files/private
RewriteBase /site2/system/files/private
RewriteBase /site3/system/files/private

Thus no matter how you get to that private dir, you are always redirected back through the site it belongs to via the system/files call, which makes drupal check your permissions. I have tested it alot and have not been able to get a file from a given site unless I'm logged in. E.g. if I am not logged into site1, then I can't get:

http://mydomain/site1/sites/mydomain.site1/files/private/somefile.jpg
or even
http://mydomain/site2/sites/mydomain.site1/files/private/somefile.jpg
http://mydomain/site3/sites/mydomain.site1/files/private/somefile.jpg
or
http://mydomain/sites/mydomain.site1/files/private/somefile.jpg

since all redirect me to:

http://mydomain/site1/system/files/private/somefile.jpg

which gives me "You are not authorized to access this page"

aaroninaustin’s picture

aaroninaustin commented

zeebo, your describing my exact setup. The only issue I'm having is when someone is denied access, instead of getting "You are not authorized to access this page" the user gets stuck in a redirect loop. Any ideas?

zeebo’s picture

zeebo commented

I'm not real experienced w/ Drupal yet so I don't know how much I can help. My only guess is that maybe you're redirecting your 403 errors through Site Configuration -> Error Reporting, and the error page that you're redirecting to does not allow unauthorized users (e.g. through some access control module like Content Access) permission to view that error page, thus spawning another 403 error, making a redirect loop.

johnhanley’s picture

johnhanley commented
Status: Active » Closed (fixed)