Index: includes/file.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/file.inc,v
retrieving revision 1.66
diff -F^f -u -r1.66 file.inc
--- includes/file.inc	8 Mar 2006 23:42:55 -0000	1.66
+++ includes/file.inc	10 Mar 2006 06:20:07 -0000
@@ -565,27 +565,28 @@ function file_transfer($source, $headers
 
 /**
  * Call modules that implement hook_file_download() to find out if a file is
- * accessible for a given user. If a module returns an array of headers, the
- * download will start. If a module denies it, drupal_access_denied() will be
- * called. If no module responds then drupal_not_found() will be called.
+ * accessible and what headers it should be transferred with. If a module 
+ * returns -1 drupal_access_denied() will be returned. If one or more modules
+ * returned headers the download will start with the returned headers. If no
+ * modules respond drupal_not_found() will be returned.
  */
+
 function file_download() {
-  $file = $_GET['file'];
-  if (file_exists(file_create_path($file))) {
-    $list = module_list();
-    foreach ($list as $module) {
-      $headers = module_invoke($module, 'file_download', $file);
-      if (is_array($headers)) {
-        file_transfer($file, $headers);
-      }
-      elseif ($headers == -1) {
-        drupal_access_denied();
-      }
+  $filepath = $_GET['file'];
+
+  if (file_exists(file_create_path($filepath))) {
+    $headers = module_invoke_all('file_download', $filepath);
+    if (in_array(-1, $headers)) {
+        return drupal_access_denied();
+    }
+    if (count($headers)) {
+        file_transfer($filepath, $headers);
     }
   }
-  drupal_not_found();
+  return drupal_not_found();
 }
 
+
 /**
  * Finds all files that match a given mask in a given
  * directory.
Index: modules/upload.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/upload.module,v
retrieving revision 1.77
diff -F^f -u -r1.77 upload.module
--- modules/upload.module	22 Feb 2006 10:06:46 -0000	1.77
+++ modules/upload.module	10 Mar 2006 06:20:08 -0000
@@ -143,8 +143,14 @@ function upload_file_download($file) {
                      'Content-Length: '. $file->filesize,
                      'Content-Disposition: '. $disposition .'; filename='. $name);
       }
+      else {
+        return -1;
+      }
     }
   }
+  else {
+    return -1;
+  }
 }
 
 function upload_form_alter($form_id, &$form) {