diff --git a/modules/private_upload/private_upload.module b/modules/private_upload/private_upload.module
index 561aeea..06ec955 100644
--- a/modules/private_upload/private_upload.module
+++ b/modules/private_upload/private_upload.module
@@ -244,10 +244,44 @@ function private_upload_file_download($file) {
         return; // Access is ok as far as we are concerned.
       }
     }
+    // Now check if this file is in a CCK file field and if we have access
+    if (module_exists('content') && module_exists('filefield_paths')) {
+      if (private_upload_cck_access($filepath)) {
+        return;
+      }
+    }
     return -1; // No nodes are granting access, so veto download.
   }
 }
 
+function private_upload_cck_access($filepath,$account = NULL) {
+  // Find the fid for the file path, there should be only one
+  $fid = db_result(db_query("select fid from {files} where filepath = '%s' limit 1",$filepath));
+  if (empty($fid)) {
+    return FALSE;
+  }
+  // Now we have to find the CCK file field the file is in, only check fields 
+  // that start with the private directory in their filefield_path
+  $private_dir = variable_get('private_upload_path', 'private');
+  // evil hack alert, we could unserialize these values one by one, this is faster and works
+  $result = db_query('select type,field from filefield_paths where filepath like \'%:"%s/%\'',$private_dir);
+  while ($row = db_fetch_array($result)) {
+    $fieldinfo = content_fields($row['field'],$row['type']);
+    $dbinfo = content_database_info($fieldinfo);
+    $result = db_query(
+      'select n.nid from {node} n,{%s} t where n.vid=t.vid and %s = %d',
+      $dbinfo['table'],$dbinfo['columns']['fid']['column'],$fid);
+    while ($row = db_fetch_array($result)) {
+      if (content_access('view',$fieldinfo,$account,node_load($row['nid']))) {
+        return TRUE;
+      }
+    }
+  }
+  // Nope, nothing found, not giving access
+  return FALSE;
+}
+
+
 /**
  * Implementation of hook_nodeapi().
  */
@@ -577,8 +611,11 @@ function private_upload_admin_validate($form_id, $form_values) {
  */
 function _private_upload_add_htacess() {
   $path = file_create_path( _private_upload_path() .'/.htaccess' );  
-  file_save_data( "SetHandler This_is_a_Drupal_security_line_do_not_remove
-Deny from all", $path, FILE_EXISTS_REPLACE );
+  $private_dir = variable_get('private_upload_path', 'private');
+  file_save_data("<IfModule mod_rewrite.c>\nRewriteEngine on\n".
+      "RewriteBase /system/files/$private_dir\n".
+      'RewriteRule ^(.*)$ $1 [L,R=301]'."\n"."</IfModule>\n",
+      $path, FILE_EXISTS_REPLACE );
   drupal_set_message("Added .htaccess file at $path");
 }