Thanks to help from Drupal Cloud support I was able to get the certificate protection to work for some of my website's page.
Now the client wants some documents linked to those pages and those document must also be certificate protected. It is my understanding that any documents uploaded and linked to the pages is findable by search engines, even if the page it is linked to is cert protected. If this is true, I need to have a way to set up a folder on the website server that will be MIT cert protected. I don’t want to have to ask them to put the protected documents on a non-drupal cloud site, kind of defeats the purpose of having everything on the new site.
K
asphodel@mit.edu
You are correct in that files currently uploaded to Drupal Cloud are directly downloadable if someone has the full link, even if they're behind certificate-protected pages (though I don't think they're indexable by search engines because search engines can't access certificate-protected pages). I don't see a way to make those files private unless the Drupal Cloud infrastructure allows a directory to be created for the "private file system path."
I can suggest a slightly kludgy workaround to set higher protection on those files: upload the files as password-protected zip files and post the password on the certificate-protected page. That way, even if someone can download the file with the direct link, they wouldn't be able to open it if they can't access the cert-protected page.
8/14/14
laurakan@mit.edu
Wow, that is a potential dealbreaker for me. I can't ask my users to open a zip file and enter a password for every form they need every time they submit an application, which may involve multiple (possibly 10-15) forms and frequent submissions. (No, at the moment it doesn't work to combine them into a single document, nor can users download them once, as they change often -- it's a system I inherited and upgrading it to the 20th [yes] century is slow going).
Any chance of this changing? My current (non-drupal cloud) site does not allow access via the full link. At this point I'll leave the forms on my current server, but I'd love for everything to live in one place.
10/13/14
kiirja@mit.edu
This was a total deal-breaker for my client. We had to find a non-Drupal Cloud solution.
10/14/14
laurakan@mit.edu
Anything simple? (I'm guessing not.)
10/14/14