Guide 05 · Developer docs

Content types and custom entities

Which built-in type fits which purpose, how categories, tags, slugs, custom URLs and SEO settings behave across them, how revisions and publishing gate what the public sees, how to model a domain the platform has no type for, and where uploaded files live.

L1–L3
Unit 06 · Media and files

File access, sharing and expiry

Media and files Page 33 of 35 Updated

Files in the file manager are public by design: anyone with a file's address can download it. What sharing a file with a user does and does not do, how an expiry date works, and where to read about files only members should reach.

Who this is for. Developers and project leads planning downloads on a member site. After this page you know what the file manager controls and what it does not, and you will not promise members-only downloads it cannot deliver.

Files are public by design

Every file and image in the file manager is served to anyone who has its address. The route that delivers files makes no access check: not whether anyone is signed in, not their group, not the permissions of the page or record that links to the file. A file has no publish switch, and the file manager is not private storage; it is where assets meant to be delivered are kept.

So gating a page does not gate the files it links to. A member who can see a gated page sees the addresses of its files, and those addresses work for anyone.

What sharing a file with a user does

The file manager can share a filename with a user. A share is a record that links one filename to one user, each pair at most once, and shares can be listed, added, changed and removed through the API as well as in the admin. It records who a file has been shared with, for the people who manage files.

A share is not a permission. The route that delivers files never looks at shares, so a shared file is exactly as public as any other, and a file that is shared with nobody is no harder to download. Do not describe sharing to a client as granting access.

Expiry dates: a download that ends

A filename can have an expiry date. Once the date has passed, a scheduled task that runs once a day deletes the filename, and with it the file or image behind it. From then on the address delivers nothing, to anyone.

That makes an expiry date the way to hand out a time-limited download: a link given out today stops working after the date. Two consequences to plan for:

  • The deletion is permanent. An expired file is not hidden or archived, and the address cannot be reissued from it. Keep the original elsewhere if it might be needed again.
  • The task runs once a day, so a file can stay available for up to a day after its expiry date has passed.
No members-only file delivery

The file manager has no members-only delivery. Before you commit to a design that needs it, read Members-only files for the alternatives.

Files only members should reach

For a file that only signed-in members should be able to download, the file manager is the wrong place. Members-only files, in the members guide, sets out what to do instead, such as keeping those files off the platform and handing out a short-lived signed link after checking the member. How the file manager stores files is on Folders, filenames and file revisions.

Go deeper
GuideMembers-only files GuideFolders, filenames and file revisions GuideDuplicate strategy and upload folders

Was this page helpful?

Your answer goes to the docs team.