Tech

Drupal private file mystery -- who has access?

What is the default drupal private file/image field behavior?  It is a mystery.  Is it only for authenticated users?  Will it ever be visible publicly?

For more context, we are talking about files found in system/files/*.

Here is the short summary (TLDR):

If you have access to view the content, then you can view the private files attached to it.

Some scenarios:

hook_form_alter vs hook_entity_access

Hooks

Most Drupal devs are familiar with hook_entity_access (and its cousins hook_ENTITY_TYPE_ID_access and hook_node_access). However, it is mostly used for serving “403: Access denied” to browsers.  And we use a separate hook, hook_form_alter to disable edit buttons on admin pages like content overview pages, node form edit and taxonomy form edit.

Prometsource milestones

Rocks and milestones

It is important to celebrate milestones.  It reminds us of God's faithfulness in our lives.  It gives us strength in times of trouble.

I am writing down the list of important activities and milestones in my career in Prometsource (November 2017 - January 2022) in a chronological order.