? example.patch
Index: file.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/file.inc,v
retrieving revision 1.121.2.5
diff -u -p -r1.121.2.5 file.inc
--- file.inc	20 Oct 2008 09:42:31 -0000	1.121.2.5
+++ file.inc	12 Apr 2009 08:31:40 -0000
@@ -829,13 +829,20 @@ function file_transfer($source, $headers
 function file_download() {
   // Merge remainder of arguments from GET['q'], into relative file path.
   $args = func_get_args();
-  $filepath = implode('/', $args);
+  $filepath = implode('/', $args);	
 
   // Maintain compatibility with old ?file=paths saved in node bodies.
   if (isset($_GET['file'])) {
     $filepath =  $_GET['file'];
   }
 
+if (variable_get('file_downloads', FILE_DOWNLOADS_PUBLIC) == FILE_DOWNLOADS_PRIVATE) {
+  $tmp = explode("/",$filepath);
+  $filepath = file_directory_path()."/".array_pop($tmp);
+  unset($tmp);
+}
+
+
   if (file_exists(file_create_path($filepath))) {
     $headers = module_invoke_all('file_download', $filepath);
     if (in_array(-1, $headers)) {
@@ -848,7 +855,6 @@ function file_download() {
   return drupal_not_found();
 }
 
-
 /**
  * Finds all files that match a given mask in a given directory.
  * Directories and files beginning with a period are excluded; this