--- private_upload.module.ORIG	2009-06-19 11:51:33.000000000 -0700
+++ private_upload.module	2009-06-19 11:51:15.000000000 -0700
@@ -71,10 +71,17 @@ function private_upload_menu() {
     'access arguments' => array('administer site configuration'),
     'page callback' => '_private_upload_migrate_private',
     'type' => MENU_CALLBACK,
-  );    
+  );
+
   return $items;
 }
 
+/**
+ * hook_perm().
+ */
+function private_upload_perm() {
+  return array('download private files');
+}
 
 /**
  * hook_requrements().
@@ -239,7 +246,7 @@ function private_upload_file_download($f
                        "WHERE f.filepath = '%s'", $filepath);
     while($row = db_fetch_array($result)) {
       $node = node_load($row['nid']);
-      if (node_access('view', $node)) {
+      if (node_access('view', $node) && user_access('download private files')) {
         return; // Access is ok as far as we are concerned.
       }
     }