November 09, 2010
Setup up Private Downloads module in Drupal
Goal: Your Drupal site has a Public file system but you have files you want to limit access to. This is the Public/Private File system conundrum. The following demonstrates how to solve your problem using the Private Download module.
1) Understand your system:
- There shouldn't be a private folder in sites/default/files/
$ ls -al sites/default/files
- Are you operating out of a sub-directory? If your Drupal code is found in www.example.com/drupal then you're in a sub-directory. For the record, I'm in a sub-directory and I've set the base_url in settings.php to represent this.
2) Install and enable the Private Download Module
3) Configure Private Download settings (admin/settings/private_download)
- if you're in a sub-directory check the RewriteBase rule and prepend your directory name to it if it isn't there already:
- Save configuration
4) Check to make sure you now have a "private" directory with an .htaccess file
$ ls -al sites/default/files/private
$ ls -al sites/default/files/private/.htaccess
5) Specify which Roles can access files within the "private" directory. Go to admin/user/permissions to configure permissions
- Under "private_download module" check the "authenticated users" box. This will allow anyone who logs into your system to "access private download directory." Of course, you can create your own roles (admin/user/roles).
- Save permissions
6) Add a CCK FileField to a content type, let's call them myFile and myContentType, respectively.
- When configuring myFile go to Path settings > File path and specify "private" (without quotes.) Any files uploaded through this field will end up in the "private" directory.
7) Upload a file
- Create Content > myContentType
- Upload a file into the myFile field. Let's call it test_download.txt.
8) Everything should be setup now but you can verify everything works:
- Right click on test_download.txt, it should download (or open in browser)
- Left click on test_download.txt > Copy Link Location
- Open a new browser tab and try either of these URL's (both should produce an "Access denied" error:
Note: The second URL should be re-written to the first in the browser.
Posted by kkwaiser at November 9, 2010 04:01 PM