Private download (module)

Version reviewed: 6.x 1.0

Sometimes you want to avoid anonymous users to download certain files from your site. For most of the sites, the settings for the download method in the file system (Administer>>Site configuration>>File system) is set to public to avoid problems with external programs like FCKeditor, etc. That means that everybody can reach them. Changing that setting doesn't seem to be a good idea, because Drupal warns about possible problems with previous uploaded files.

You might think that changing the permissions for the upload module (permissions that are activated by enabling upload under the core-module) are the solution. By unchecking anonymous user for view uploaded files they can't see the files anymore. Or can they?

A quick test reveals that they can. It's true, when unchecked, the anonymous user can't see the file attachment under a node anymore. BUT the file is still accessible when the user knows the path. And when you make a link to the file inside your node, everybody can follow that link and access the file.

private download vs private upload

Two modules come to your rescue: private download and private upload. Both avoid unauthorised users to access certain files, but they work differently. private upload will work for attachments, private download for links inside a node. And because I prefer to make the link in the node, I prefer private download.

Downside

There is one downside though with private download. It doesn't work with File attachments. You have to put the link to the file inside the node and you'll have to upload the file with an FTP-client (like FileZilla).

A private directory

The module creates a directory (called private by default), and makes the directory inaccessible for unauthorised users by creating a .htaccess file inside. All the files you put inside the directory are protected.

Download, extract, install and enable the module (see adding a module). Set the permissions like you feel (Administer>>User management>>Permissions and look for private_download module), and start to configure the module. When you leave everything as it is, private will be created as an extra directory inside your default file system path. And you can start working.

Before you should change settings, a warning first: if you use a HTML text-editor like FCKeditor, you have to switch it off before changing anything here. You will fiddle with code, and you don't want to mess that up with what the editor should add.

Go back to 'Modules'