Hi.
I found some problem.
When i set off "view" permission for anonymous user for node
i still can access to images and files (CCK fields) of this node by URL.

Example:
Node http://site/node/87 is not available for anonymous, but
image http://site/system/files/images/fil12.tmp_.png?1250592301 is available.

Is its bug or i do something wrong?

P.S. Download method in fylesystem settings is set to "private".

Comments

chebrushaka’s picture

chebrushaka CreditAttribution: chebrushaka commented
Status: Active » Needs work
emptyvoid’s picture

emptyvoid CreditAttribution: emptyvoid commented
Status: Needs work » Closed (won't fix)

This is not a bug, the system does not integrate with cck, upload module, or the local file system. if you wish to hide access to files you will need to extend the upload module and or set the files on the server to only be accessible by specific user accounts other than apache (and or everyone).

Sorry.

Jody Lynn’s picture

Jody Lynn
she/her
Primary language English
CreditAttribution: Jody Lynn commented
Version: 6.x-1.7 » 6.x-1.8
Status: Closed (won't fix) » Active
Issue tags: +Node_access does not integrate with files or any other modules

The fact that a Drupal module does not integrate with most of core Drupal is not only critical, but something that potentially users should be warned about on the project page. It is potentially a security issue as well, because it breaks the core private files system and gives access to files on nodes which it claims to be protecting.