Securing Files in File Manager

Overview

Files stored in the file manager are not restricted by access rights by default.  Even if you have a webpage that requires login, any linked images, videos, pdf files that are referenced on the page and are stored in file manager can be accessed by anyone if they know the url.  Usually this is not an issue, but for sensitive documents that need to be secured the files need to be stored in a special folder in file manger.    If you need to control access to specific files on a granular basis, it is best to store the files in the Downloads module.

Securing media files in the File Manager

1. In the folder you would like to secure, upload/create a file called .access.  You can navigate to the folder and click "Create New Text File" in the right panel labeled "Actions".  Do not give it a .txt suffix.
2. Two lines are required in the file.  The first line will specify the access groups that will be able to access the files in the secure folder once they log in. The second line  specifies the page that will be displayed to users that will allow them to log in and view the file(s). Below is an example of the contents of such a file: 
   
   Groups Administrators,Partners
   LoginPage /login/
   
   To specify multiple groups, separate with commas and no spaces

Note that all files can not be served in the secure folder, they will only be downloaded.