I'm working on a pet project web site using Joomla! to organize my apartment (i.e. itemizing and photographing belongings (great for insurance), appliances with attached scanned receipts and warranties, having access to medical documents (i.e in case of emergencies), shopping lists, joint calendars, photo albums, Google Map etc.)

However, my main concern is that some of these documents are quite sensitive.

These are the following 'user-groups' that I would like to set up in ACL.

  • General Public
  • Friends and Family (i.e. access to specific photo albums, events etc.)
  • Residents (access to everything, including the 'sensitive docs')

I would like to set up the Joomla! site using ACL so that only those in the 'Residents' user group have access to download the docs (i.e. a download link with a description is only shown to those logged in as Residents and only Residents User Group members can download the docs).

  1. Can this be done with Joomla!'s native ACL? How? if not;
  2. What extensions can I use and how can this been accomplished?

Again, the main concern is how to make these sensitive docs and their description readily available authorized users, while protecting them from those who are not?

2 Answers 2


DocMan will do this. http://www.joomlatools.com/extensions/docman/overview

Configure your user groups with this inheritance:

  • Public
    • Friends and Family (inherits the PUBLIC settings but has more access)
      • Residents (inherits the Friends and Family settings but has more access)

Then configure your categories and documents in the DocMan component with the correct access levels. I like to set my DocMan categories for the minimum level of access (in your case, PUBLIC), then set the access levels of the individual files. This way, everyone can see the categories, but only those with the required access can see the documents.


I tend to use Docman for this sort of thing, but you could still use the built in ACL to control regular articles and then embed document urls in the articles. If you've got a lot of documents though, I'd say a doc manager like Docman is worth looking at. You can set up groups and even have it hide categories you don't have access to.

As far as the other items, such as galleries, etc. Some components honor the ACL system and some don't (look for the properties button in the component). Another way is to use something like widget kit and embed the galleries in a joomla article.

Short answer is, yes, the built in ACL can be used to hide categories, articles, menu items, modules, etc so you should be able to set this up without too much trouble.

  • 1
    Thanks. A lot of useful info. If I'm relying solely on ACL and an unauthorized user has a 'link' to the document (just like a link to an image) I believe the unauthorized user can still download it - does ACL (or Joomla!) have any capabilities built in to protect from that?
    – NivF007
    Apr 22, 2014 at 18:19
  • 2
    If you use docman for downloadables, they will not be able to download it. I have't tested it, but I suspect they'll be greeted with a login window. The built in ACL can't really manage files that you manually link to, so as far as I know, the answer is no, it doesn't have anything built in.
    – Brian Peat
    Apr 22, 2014 at 18:25
  • DocMan would solve that issue. Depending on your config, the user either sees a login screen or, if they are logged in, they would see the 403 error screen. This works even if you include a link to the DocMan document in an article and set the article to PUBLIC. The PUBLIC user can't download the file but they can see the clickable (but useless) link.
    – rleathers
    Apr 22, 2014 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.