Why accessing a forbidden file returns 404 Not Found?

[adrien-delhorme]

I need to allow access to some files only for "members" (logged in users within a group), and to promote the subscription to the website with a message like "Subscribe to access this resource!".

Unfortunately the current behavior is to return "404 Not found" when access to a file is forbidden (when not in DEBUG).
Is there a reason for this?

https://github.com/django-cms/django-filer/blob/011d80407cfe1cb0047678bd2de82190873a07a4/filer/server/views.py#L27,L30

[marksweb]

Seems it's been that way for 14 years. But if it's not allowed, it should be a 403.

So it probably wants to return HttpResponseForbidden()

[fsbraun]

I'd suggest some custom view that redirects to the file if allowed or offers the subscription message.

[adrien-delhorme]

Currently I use the template 403.html to display a subscription message. That's enough for my use case for the moment.