I have set up my Drupal 7 site for private files in a directory above root (../private). I also set my filefield on my node type to upload the image files to that private directory.
I have two user roles: man and woman. Both user roles can create nodes of a certain type, containing that image file field. Men can never see another man’s photo; same thing for women. Men can always see a woman’s photo; same thing for women.
Here are my current results:
When a man visits a woman’s node, he can view the photo within the node content: http://example.com/members/76/gallery/public/photo-123
When that man views the page source and copies the image URL, he can view that image directly in his browser: http://example.com/system/files/styles/apply_simplecrop/private/pictures/1/Public/filename.jpg?itok=ABC123&sc=abcdefghijklmnop
If that man shares that direct link with another man, that other man can view that picture as well. If he shares the direct link with a woman or a non-logged-in user they are served an Access Denied message and cannot view that picture.
If a man tries to access that image URL without the “itok=” text in the link, he receives an Access Denied message.
My desired result in all of those examples above is to display an Access Denied message.
The ../private directory has an htaccess file containing Deny from all.
Am I missing a step? What can I do to securely deny direct access to those files in the way that I described above?
Thanks!
Sponsored by SupremePR
