Drupal Private File Downloads With Public Files Access Set

16th August 2010 - 3 minutes read time

Note: This post is over a year old and so the information contained here might be out of date. If you do spot something please leave a comment and I will endeavour to correct.

Drupal has two ways in which to allow users to download files, these are private and public.

With public the files are open for anyone to download and Drupal is not involved in the download process. This means that no statistics are recorded or permissions used when downloading the file. Each file is referenced by name.

Private file access means that Drupal is run every time a file is downloaded. This allows the download to be recorded and a permissions check run to make sure that the user in question is allowed to access the file. Each file is referenced by a path that can be completely different from the original filename.

The main problem with using private file access is that it can cause problems if you allow your users to upload images to be part of the template (like header images and things). It can also cause a massive performance hit if you turn it on and allow a lot of different files to be used, as each file must be passed through Drupal to figure out if it is allowed to be downloaded by the current user.

The downside of private files is that it also means that you can't restrict access to just the documents on your site as the permissions set are for all files.

It is possible to get private file downloads with public file access by using the following .htaccess rule. This can be placed in the IfModule mod_rewrite.c block.

RewriteRule ^sites/drupal/files/([^/]*?)$ index.php?q=system/files/$1 [QSA]

If you want to use a folder for a specific URL then you can do it like this:

RewriteRule ^sites/www\.example\.com/files/([^/]*?)$ index.php?q=system/files/$1 [QSA]

This rule will tell Apache that if the file is in the root of the files directory and not in any sub-directory then the filename must be passed onto Drupal. The regular expression returns a string as long as there isn't a slash in the filename. This way we can use the root directory for our downloadable files and allow permissions and statistics to be used on those files. All of the subdirectories of the sites/default/files directory can be used for user images and theme items without having to bootstrap Drupal.

files

Drupal

Comments

Permalink

but what if my website is running on Nginx webserver not Apache, who can I do the same functionality ?

Permalink

I don't know to be honest. I don't have much experience with Nginx. Although from my research into it so far I think it follows the same .htaccess format as Apache. Although I could be (and probably am) wrong.

Add new comment

Related Content

Drupal 9: Customise Your Robots.txt File

A robots.txt file tells search engines spiders what pages or files they should or shouldn't request from your site. It is more of a way of preventing your site from being overloaded by requests rather than a secure mechanism to prevent access. It really shouldn't be used as a way of preventing access to your site, and the chances are that some search engine spiders will access the site anyway. If you do need to prevent access then think about using noindex directives within the page itself, or even password protecting the page.

Drupal 9: Get List Of Content Types

Getting a list of content types out of a Drupal 9 site is useful in a few situations. Mostly, I find that when creating a service of some kind that I will also create an administration form for that service to allow it to be restricted to certain content types. This list can be saved to configuration so that when the service is run it only effects certain content types, based on the saved configuration.

To get a an array containing a list of the content types on a Drupal site you can use the following code.

Drupal 9: Auto Tweeting From A Drupal Site When Content Is Published

Normally, when creating Tweets from Drupal 8 I use the Social Post Twitter module. This module is part of the Drupal Social Initiative and has been my go-to module when I've needed to read or send Tweets from a Drupal site. Since the release of Drupal 9, however, these modules have not been receiving the support needed and as of writing this article there is no easy way to install them on a Drupal 9 site.

Drupal 9: How To Tell If A Page Is First Published

I was writing some code on a Drupal site that detects if a page is being published and I realised that this state isn't as clear cut as you might expect. Drupal stores the published state of a page as the 'status', with 0 being unpublished and 1 being published. With revisions being turned on by default since Drupal 8 it is possible to see past states of the page when saving the page. The issue is that there is nothing in the current state of the page stating that this is the first time it is being published.

Drupal 9: Some Strategies For Developing Update Hooks

Drupal's update hook system is a powerful way of updating your site to introduce things that wouldn't be handled using the configuration system.

Modules will use update hooks to bring sites that have the old version of the module in line with the latest additions to the module. For example, if a new field is added to a table that the module uses then an update hook will be needed to add that field to all sites that are current using the old version. This update hook will be in addition to the install hook that would install the table with the added field in the first place.

Drupal 9: Cascading Ajax Select Forms

Tying together different select elements in a form is done with very little effort thanks to the ajax and states system built into Drupal 9. This means that any Drupal form can have a select element that shows and updates options into another select element within the same form. Using this system you can create a hierarchical system where one select will show and populate another select element with items dependent on the first. This is great for giving the user the ability to drill down into options that are dependent on each other.