First, I do not have this issue with images since by marking them as Externally Available allows them to be accessed from the ImageServer servlet which does not have this problem.
Second, to reproduce this you must clear out your cache, cookies, restart the browser, etc. to ensure that you are not logged in to an SF org as your "normal" dev user. If you don't have everything set up just right, you will not be able to reproduce it.
I have a customized Force.com site and Customer Portal working together in a sanbox. The portal users are High Volume Customer Portal users. Some pages require no authentication (i.e., public/guest) and some require authentication. I'm having an issue where the authenticated user cannot see Documents files (e.g., a pdf), even though the guest/public user can.
Here's what's happening:
- Guest/public user clicks the link that was created with
<apex:outputLink>with a value of
/servlet/servlet.FileDownload?file=<recId>and sees the pdf because I set up sharing on the folder that the file is in to include the Guest User. No problem.
- User logs in becoming an authenticated HVCP user.
- User clicks on that same link on that same page and they get a Insufficient Privileges error. PROBLEM!!!
According to http://login.salesforce.com/help/doc/en/customer_portal_manage_users.htm the HVCP User cannot be included in sharing rules for Documents; however, it seems like there should be some way for them to view it since the use case I've described seems completely reasonable that if the whole world (i.e., guest user) can see the document the authenticated user should be able to as well.
I do see All Users and All Customer Portal Users as options on the folder share. I tried that, but it didn't work, I assume, because it doesn't include the HVCP licensed users, since they cannot be included in sharing rules.
Both the portal profile and the guest/public profile have Read CRUD set on the Documents.
How can I get the authenticated High Volume Portal user to be able to see the Document? I feel like I must just be missing something obvious.
Am I missing something? Has anyone had to handle this situation? Is there a known solution?