Index: modules/upload.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/upload.module,v
retrieving revision 1.96
diff -u -p -r1.96 upload.module
--- modules/upload.module	18 Apr 2006 08:32:04 -0000	1.96
+++ modules/upload.module	25 Apr 2006 10:36:05 -0000
@@ -27,7 +27,7 @@ function upload_help($section) {
     case 'admin/modules#description':
       return t('Allows users to upload and attach files to content.');
     case 'admin/settings/upload':
-      return t('<p>Users with the <a href="%permissions">upload files permission</a> can upload attachments. You can choose which post types can take attachments on the <a href="%types">content types settings</a> page.</p>', array('%permissions' => url('admin/access'), '%types' => url('admin/settings/content-types')));
+      return t('<p>Users with the <a href="%permissions">upload files permission</a> can upload attachments. Users with the <a href="%permissions">view uploaded files permission</a> can view uploaded attachments. You can choose which post types can take attachments on the <a href="%types">content types settings</a> page.</p>', array('%permissions' => url('admin/access'), '%types' => url('admin/settings/content-types')));
   }
 }
 
@@ -144,10 +144,10 @@ function upload_download() {
 }
 
 function upload_file_download($file) {
-  if (user_access('view uploaded files')) {
-    $file = file_create_path($file);
-    $result = db_query("SELECT f.* FROM {files} f WHERE filepath = '%s'", $file);
-    if ($file = db_fetch_object($result)) {
+  $file = file_create_path($file);
+  $result = db_query("SELECT f.* FROM {files} f WHERE filepath = '%s'", $file);
+  if ($file = db_fetch_object($result)) {
+    if (user_access('view uploaded files')) {
       $node = node_load($file->nid);
       if (node_access('view', $node)) {
         $name = mime_header_encode($file->filename);
@@ -164,9 +164,9 @@ function upload_file_download($file) {
         return -1;
       }
     }
-  }
-  else {
-    return -1;
+    else {
+      return -1;
+    }
   }
 }