Can I restrict which members can access the Files?

How to restrict access to private files to members of an organic group?

• I have an organic group with a file field that stores its files in a private directory (sites/default/files/private/). These files are visible only to members of that group. But, as is commonly known, if someone guesses the Drupal path even if he is not a member of that group or not even logged in, he can access that file by using the correct file link directly. How can I restrict file access to group members?

• Answer:

  OG provides no access control on attached files. I ran into the same situation and came up with two options. The file depot module (https://drupal.org/project/filedepot) integrates nicely with OG and does prevent users who are not members of a group from accessing files that are attached to a group. Another option is writing a custom module that implements hook_file_download. In that module you would have to get the node id of the file attachment then use that to determine what group the node belongs too then from there determine if the logged in user is a member of the group. If they are not a member of the group the module would return -1 which would give them access denied if they try to directly download the file via url.