Hello,

I use the private file system and I have a problem with links to download files.
The problem is visible in a view that lists the files (see picture).
With the user 1 account I can download only the latest uploaded file. Other files display an access denied.

After checking the download links I see that the token placed in the url is still the same.
First link : ...mysite.com/file/4/download?token=enMYyAfPORkgsmtSISmolXmfaw2C2A1ZiN1XZTCXbvY
Second link : ...mysite.com/file/3/download?token=enMYyAfPORkgsmtSISmolXmfaw2C2A1ZiN1XZTCXbvY
Third link : ...mysite.com/file/2/download?token=enMYyAfPORkgsmtSISmolXmfaw2C2A1ZiN1XZTCXbvY
...
This token is the problem?

Have you encountered this problem? Thank you for your help.

The following modules are installed:
Views 7.x-3.7
ctools 7.x-1.3
admin views 7.x-1.2
File entity 7.x-2.0-alpha2
entity 7.x-1.2
VBO 7.x-3.1

Comments

kumkum29’s picture

Hello,

if I change the view display (table) to unformatted list + file display, download links are ok.
I see that the token placed in the link is different from one file to another.
The table view display created always the same token. The problem comes from the token.

I hope this help you to understand the problem.

Thanks

manicato’s picture

I have the same problem:

/file/2609 > I have access to the file
/file/2609/download > Access denied

manicato’s picture

Issue summary: View changes

rev2

rafal.cygnarowski’s picture

This is File entity module problem and IMHO should be fixed.
Following patch is a temporary solution:

diff -Nur file_entity.orig/views/views_handler_field_file_link_download.inc file_entity.chng/views/views_handler_field_file_link_download.inc
--- file_entity.orig/views/views_handler_field_file_link_download.inc   2013-11-10 14:45:41.000000000 +0100
+++ file_entity.chng/views/views_handler_field_file_link_download.inc   2013-11-13 22:27:45.000000000 +0100
@@ -21,6 +21,7 @@
       return;
     }

+    unset($this->options['alter']['query']);
     $this->options['alter']['make_link'] = TRUE;
     $uri = file_entity_download_uri($file);
     $this->options['alter']['path'] = $uri['path'];
ericwongcm’s picture

#3, thanks
Your code change fixed the same problem I am experiencing :)

puppyman’s picture

#3 worked for me as well. Thanks. This appears to be an issue with private and public file downloads via views.

shrop’s picture

Issue summary: View changes

I can confirm the same issue as kumkum29 in #1.

In addition, the issue persists for me for uid1 and other authenticated users who should have access.

I was able to get around this by rewriting the download link with the filename, but having a token is really the best approach and I would like to get that going again.

rudiedirkx’s picture

Priority: Normal » Major

#3 works. Pretty big bug IMO. I'm making a patch.

rudiedirkx’s picture

Project: Drupal core » File Entity (fieldable files)
Version: 7.23 » 7.x-2.x-dev
Component: file system » Code

This is a File Entity issue, not Drupal Core.

rudiedirkx’s picture

Version: 7.x-2.x-dev » 7.x-2.0-alpha3

Confirmed in alpha3. Not yet in beta1 or dev.

rudiedirkx’s picture

Status: Active » Closed (fixed)

Fixed in beta1, so closing.

nelslynn’s picture

#3 is not in Beta2... not sure if it should be, and sorry for reopening this if is should not be. None the less, applying #3 to beta2 does not help in my situation... see below

Since upgrading the to latest Drupal Core 7.43, I get access denied on all private files; user 1 and all other roles with permissions to download cannot download private files, and receive Access Denied when trying so.

Can anyone please shed some light on this? This has become a serious issue on a live site.
https://www.dropbox.com/s/ogwu9slw3023ye3/Screenshot%202016-02-26%2013.2...

thanks.

nelslynn’s picture

Version: 7.x-2.0-alpha3 » 7.x-2.0-beta2
Status: Closed (fixed) » Active

Reopening

Edit closing, got working for User 1, still issues with other users however.

nelslynn’s picture

Status: Active » Closed (fixed)