0

I have historical data recorded in pdf files for our clients. Now I am developing a web platform (in Drupal) from where clients should be able to access this data. The problem is that i don't want this files to be available to anyone else than the user to whom the information belongs.

My question is if it's possible to give access to some files or folders to specific users in Drupal. Because the alternative would be to create a Role for every user which is not practical.

Miquel Correa Casablanca
  • 225
  • 3
  • 14

2 Answers2

0

Check out this answer from Alex: https://stackoverflow.com/a/9850031/974809

It relates to the Drupal's files document: https://www.drupal.org/documentation/modules/file

Specifically the section "Managing file locations and access" which explain how to create private files.

Basically, you could do something like this:

  1. Create a node named "Private client data"
  2. Add a field named "PDF File"
  3. Configure the field to be a private file
  4. Restrict the access to the node
Community
  • 1
  • 1
santerref
  • 163
  • 1
  • 11
  • For what I've seen (and i checked this answer before asking), this solution works with roles, not single users so, in the end I would need to create a role for each user which is what I want to avoid. – Miquel Correa Casablanca Oct 13 '15 at 07:03
  • The role have permissions and one of the permission is "See own content" and "See everyone content". So only check "See own content" and not "See everyone content". Each user will only see it's own nodes. Be sure to set the author of the node to be the client. – santerref Oct 13 '15 at 14:03
0

At the end I found a solution that covers all my needs. I created a custom page template for the page from where i want to access the files (ex. node--4.tpl.php) that catches the username and generates a cookie with it:

global $user;
$username = $user->name;
$cookie_name = 'cookie_name';//
$cookie_value = $username;//
setcookie($cookie_name, $cookie_value, time() + (3600), "/");

Then I create a .htaccess file in each user's folder that contains this code:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_COOKIE} !cookiename=username [NC]
RewriteRule .* http://alternativepath/ [L]

So only the user who's username is like the username i ask for in the htaccess can access the folder. In my case I ask for another field, not the username, but this should be enough as a simple example.

Miquel Correa Casablanca
  • 225
  • 3
  • 14