Thank you so much for the PrivateMsg module. Awesome!
Now I use the privatemsg attachments, it works very well.
But I have questions here:
1) - Is there a way that only recipient can access the attachments and other user can not see(download) the attachments?
2) - Is there a way that the attachments path can not be seen in the page? Otherwise it may be downloaded by the path speculation.
What would you advise me to do? Thanks!
| Comment | File | Size | Author |
|---|---|---|---|
| #16 | Privatemsg_attachment_access.zip | 1.74 KB | danielschroeder |
| #9 | fix_private_files.patch | 2.32 KB | berdir |
Comments
Comment #1
berdirUse private files.
Yes, I know that might not be an option because of the limitiations of these, but it is the only solution here.
Drupal 7 will improve the situation by allowing to choose which files are private and which not.
Comment #2
zhongguo999999 commentedThe third question:
3) - How to delete the privatemsg attachment files? If I have deleted the private message, but the attachment file don't be deleted!
Comment #3
zhongguo999999 commentedThank you for your reply.
I have used private files, but other user can see(download) the attachments too if he/she know the attachment path. I want other user can not see(download) the attachments and only the recipitent can see(download) the attachments.
Any tips?
Any ideas on proposed solutions would be appreciated.
Comment #4
berdirA user that is not a recipient?
That should not happen, unless something is wrong with our hook_file_download implementation.
Are you sure that you are using the latest, official privatemsg_attachments module that is part of the project? Maybe you have an old version laying around somewhere... Do you have this function: http://blog.worldempire.ch/de/api/function/privatemsg_attachments_file_d...?
Comment #5
berdirPlease only use the assigned field if you actually work on an issue. Reporting does not count as "work on it" :)
Comment #6
zhongguo999999 commentedSorry, I don't put across my ideas properly.
I am sure that I are using the latest version of Private Messages(6.x-2.x-dev) and have the function(privatemsg_attachments_file_download) lined in 400.
I am sure that I selecte the Private download method in File System.
But I have the following problems:
1. Is there a way that only recipient can download the attachments and other user can not download the attachments?
A user that is not a recipient can download the attachments if he/she know the attachment path(Url) by speculation. e.g. User1 is a recipient, but user2 isn't. User2 paste the URL(by speculation) in the Address bar and can download the attachments.
2. How to delete the privatemsg attachment files while I delete the private message? In fact,the attachment file isn't deleted when I have deleted the private message!
Any tips?
Thank you!
Comment #7
berdirI do understand you, don't worry :)
1. Yes, I understand what you mean. From looking at the code, this is how it *should* work. If it doesn't, then maybe there is a bug. I will have to try it and write a test for it. It is also possible that another module implements hook_file_download() wrong and allows access to all files.
What modules do you have installed that allow file uploads? What happens if you disable them temporarly?
2. When you delete a message, it is just marked as deleted, not actually removed from the database. To actually delete it, privatemsg has a feature that removes the message once *all* recipients have deleted it. This can be configured in the privatemsg settings page.
Comment #8
xsonic commentedI'm having the same issue.
I tried it with a clean, new Drupal installation and installed only the Privatemsg module.
All users that have the right to view attachments can view all of them (not only the recipient).
File System is set to private. Using the latest dev version of privatemsg.
So any news on this one?
Comment #9
berdirConfirmed and reproduced, there was a bug in our permission check. Please try the attached patch.
Comment #10
xsonic commentedthanks a lot...
works like a charm!
Comment #11
berdirThanks for testing, commited!
Comment #12
zhongguo999999 commentedThe path in private model is http://yoursite.com/system/files/24668_1.pdf and The path in public model is http://yoursite.com/sites/default/files/24668_1.pdf.
If you paste the http://yoursite.com/system/files/24668_1.pdf in the Address bar you can not download the file!
But if you paste the http://yoursite.com/sites/default/files/24668_1.pdf in the Address bar you can download the file!
Any tips? Thank you!
Comment #13
berdirWell when you use private files, you need to set a file path that is outside of your webroot. Or at least deny access with a .htaccess file.
See for example http://drupal.org/node/344806
Comment #14
zhongguo999999 commentedOk, I do understand!
Thank you!
Comment #16
danielschroeder commentedDidn't see this patch, so I worked out my own solution. It's a standalone script and a .htaccess file to be put inside the email-attachment folder.