Template:Uploaded-files-access-restriction-info

Warning:

Setting the user right "read" (allow viewing pages) to false will only protect wiki (article, talk, ...) pages, but uploaded files (images, files, docs... in the $wgUploadPath subdirectories) will always remain readable via direct access by default. Use the information from Manual:Image authorization and img_auth.php pages when you have the need to restrict image views and file download access to only logged-in users.