User can view other user private files

Hello,

I am not sure I understand your issue sorry.

What do you mean by “I enter the url to one user’s file from another user”? Could you please attach some screenshots to show what you are trying to do?

Regards.

It’s hard to explain. But I’m going to do it in as much detail as I can.

As an example, I have this one:

File 1 is linked to user 1
if I log in as user 1 then I see the file and can download it too

Now I log in as user 2 there are no files linked to it
I now use the URL of user 1 and navigate with user 2 to the url of user 1

Now with user 2 I see the file from that is linked to user 1 and I can also download it.

I would like to disable that. Hopefully I made it a little clearer and you can help me.

Hello,

Are you experiencing this on the frontend or the backend? I mean, are those URLs like

1. mysite.com/customer-area/private-file
2. or, mysite.com/wp-admin/post.php?id=257

Regards.

Hi,

Its at the frontend.

This is the URL https://site.nl/bestanden/mijn-bestanden/2024/02/14/2e-bestand/

URL is in dutch.

Hello,

I’ll try to reproduce this behavior locally and will let you know.

Best regards.

Hello,

I cant reproduce your issue.

Could you make sure that you did not give to subscribers the permission to “view any private files” in Settings > WP Customer Area > Capabilities > Private Files.

This permission allows access to any private file post if the user is aware of its URL. The frontend still only list content assigned to the user (or authored). So in most commn cases, you shouldn’t give this permission to subscribers.

Regards.

Hi,
I will try tommorow, let u know.

Greetings.

Hi,

There i am again. So this is what is see.

https://drive.google.com/file/d/15uV3fkuh0PotP67SE9KYRD2cVm6ELYV7/view?usp=sharing

Well,

You are actually showing the “Private Pages” permissions while it seems you are experiencing an issue with the “Private Files”.

Could you check the “Privates Files” section instead?

Regards.

I am so sorry, i did not read well.

This is the good sector i guess
https://drive.google.com/file/d/1wSlXNunIkua32vshxe4ka3OG3re2Gpq9/view?usp=sharing

Hello,

I am actually not sure about the checkboxes I see there, because I don’t understand this language. But I suspect the translations from the WP.org’s translation contributors to not be really correct.

Could you please try this:

• temporarily switch the main language of your site to English
• go back to this permission table and uncheck “View any private files” permission for the subscriber role
• switch the main language

Do not hesitate to confirm if it fixes your issue, so we’ll be able to update those strings to be clearer, more understandable, and better translated from the community.

Regards.

Hi,

You’re right, I followed the steps. The problem is solved! Very nice and thank you for your help. So in the end it was a simple solution.

Solution was in:
Settings -> WP Costumer Area -> Capabilities -> Private files -> View any private file -> uncheck that box at subscriber and save settings

Thanks again

You’re welcome.