Drupal Private File Downloads With Public Files Access Set

16th August 2010 - 3 minutes read time

Note: This post is over a year old and so the information contained here might be out of date. If you do spot something please leave a comment and we will endeavour to correct.

Drupal has two ways in which to allow users to download files, these are private and public.

With public the files are open for anyone to download and Drupal is not involved in the download process. This means that no statistics are recorded or permissions used when downloading the file. Each file is referenced by name.

Private file access means that Drupal is run every time a file is downloaded. This allows the download to be recorded and a permissions check run to make sure that the user in question is allowed to access the file. Each file is referenced by a path that can be completely different from the original filename.

The main problem with using private file access is that it can cause problems if you allow your users to upload images to be part of the template (like header images and things). It can also cause a massive performance hit if you turn it on and allow a lot of different files to be used, as each file must be passed through Drupal to figure out if it is allowed to be downloaded by the current user.

The downside of private files is that it also means that you can't restrict access to just the documents on your site as the permissions set are for all files.

It is possible to get private file downloads with public file access by using the following .htaccess rule. This can be placed in the IfModule mod_rewrite.c block.

RewriteRule ^sites/drupal/files/([^/]*?)$ index.php?q=system/files/$1 [QSA]

If you want to use a folder for a specific URL then you can do it like this:

RewriteRule ^sites/www\.example\.com/files/([^/]*?)$ index.php?q=system/files/$1 [QSA]

This rule will tell Apache that if the file is in the root of the files directory and not in any sub-directory then the filename must be passed onto Drupal. The regular expression returns a string as long as there isn't a slash in the filename. This way we can use the root directory for our downloadable files and allow permissions and statistics to be used on those files. All of the subdirectories of the sites/default/files directory can be used for user images and theme items without having to bootstrap Drupal.

files

Drupal

Comments

Permalink

but what if my website is running on Nginx webserver not Apache, who can I do the same functionality ?

Permalink

I don't know to be honest. I don't have much experience with Nginx. Although from my research into it so far I think it follows the same .htaccess format as Apache. Although I could be (and probably am) wrong.

Add new comment

Related Content

Drupal 9: Configuring Drupal To Be An Identity Provider With SimpleSAMLphp

I have previously talked about configuring a Drupal site to authenticate against a remote SimpleSAMLphp install, but as Drupal is an excellent user management system I wanted to turn it around and use Drupal as the identity provider. This means that Drupal would allow users to log into other systems using their Drupal username and password by leveraging the power of SimpleSAMLphp.

Drupal 9: Configuring Drupal To Authenticate Against A Remote SimpleSAMLphp Identity Provider

I have previously talked about installing SimpleSAMLphp using composer, so the next step is setting up the system to actually provide authentication against a SimpleSAMLphp system. As I spend a lot of time using Drupal I wanted to set up the authentication with Drupal and SimpleSAMLphp in order to see how things worked.

First, let's define a couple of terms that are important to this setup.

Drupal 9: Creating A GET Form

I've been building Drupal forms for a number of years so I'm quite familiar with to putting together a Drupal form using the FormBase class and the form API. When I attempted to create a GET form this week I realised that there is actually quite a bit to think about. All forms are build using GET requests, it's the submission that I am specifically talking about. By default, forms in Drupal use POST requests to submit their data, and although it is possible to convert a form to use GET to submit data, it isn't well documented.

Drupal 9: Blocking Common Exploit Paths

If you run a Drupal site for any length of time you will quickly realise that a few paths that have nothing to do with Drupal will receive a lot of traffic. All of these paths result in page not found errors so the only impact is taking up your server resources. It's common to see paths like wp-login, xmlrpc.php, phpBB/page_header.php, postnuke/article.php, as well as a multitude of others. These requests are clearly bots probing the site to see what sort of CMS is in use and if they can exploit it or not.

Drupal 9: Changing Config Through Update Hooks

Drupal configuration is normally changed or removed through the configuration import and export process. For example, the process I follow is to make the change in the configuration locally, export the configuration into the source code, deploy the source code to a remote server and import the configuration. Using this mechanism, configuration changes that were exported locally are imported into the site and are ready to use.

Drupal 9: Setting Up Multilingual Content Views

Drupal Views is a powerful module. The ability to generate lists of things in Drupal means that it is used everywhere. It even has a powerful plugin system that allows other modules to interface with it and create more functionality.