Index: modules/upload.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/upload.module,v
retrieving revision 1.84
diff -u -r1.84 upload.module
--- modules/upload.module	29 Mar 2006 06:49:25 -0000	1.84
+++ modules/upload.module	30 Mar 2006 14:47:47 -0000
@@ -80,8 +80,7 @@
       foreach ($_SESSION['file_previews'] as $fid => $file) {
         $filename = file_create_filename($file->filename, file_create_path());
         if (variable_get('file_downloads', FILE_DOWNLOADS_PUBLIC) ==  FILE_DOWNLOADS_PRIVATE) {
-            // strip file_directory_path() from filepath 
-            // to hide relative paths in url.  see file_create_url
+            // strip file_directory_path() from filename. @see file_create_url 
             if (strpos($filename, file_directory_path()) !== false) {
               $filename = trim(substr($filename, strlen(file_directory_path())), '\\/');
             }
Index: includes/file.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/file.inc,v
retrieving revision 1.69
diff -u -r1.69 file.inc
--- includes/file.inc	29 Mar 2006 06:49:25 -0000	1.69
+++ includes/file.inc	30 Mar 2006 14:47:50 -0000
@@ -27,11 +27,7 @@
  * @return A string containing a URL that can be used to download the file.
  */
 function file_create_url($path) {
-  // strip file_directory_paths from url if present. Prevent ugly and filesystem revealing 
-  // urls like http://example.com/system/files/../../../home/gatsby/private/files
-  // I think it also keep absolute file_directory_paths working since they would get broken if
-  // we tried to pass them in the url.
-
+  // Strip file_directory_path from $path. We only include relative paths in urls. 
   if (strpos($path, file_directory_path()) !== false) {
     $path = trim(substr($path, strlen(file_directory_path())), '\\/');
   }
@@ -578,14 +574,11 @@
  */
 
 function file_download() {
-  //use the remainder of the path to get the file.
-  //enables 4.7 clean private files paths.
+  // Merge remainder of arguments from GET['q'], into relative file path.
   $args = func_get_args();
   $filepath = implode('/', $args);
 
-  // add the ?file= if it is present. Otherwise we 
-  // break all old nodes with private files displayed 
-  // inline.
+  // Maintain compatability with old ?file=paths saved in node bodies.
   if (isset($_GET['file'])) {
     $filepath =  $_GET['file'];
   }