--- private_upload.module.orig	2010-05-24 02:37:23.751271362 -0400
+++ private_upload.module	2010-05-24 03:19:24.735273233 -0400
@@ -237,9 +237,32 @@
     $filepath = file_create_path($file);
     $result = db_query("SELECT DISTINCT(u.nid) FROM {upload} u INNER JOIN {files} f ON u.fid = f.fid ".
                        "WHERE f.filepath = '%s'", $filepath);
+
+    $allowed_roles = variable_get('private_upload_roles', array());
+    if (empty($allowed_roles)) {
+      // Fallback to default node access behavior if no roles are checked.
+      $has_role_access = TRUE;
+    } else {
+      // If user does not belong to any role defined in
+      // private_upload_roles, then set $has_role_access to FALSE.
+
+      // Otherwise, the user has role access, and $has_role_access
+      // is set to TRUE.
+
+      $allowed_roles = array_keys(array_filter($allowed_roles));
+      $has_role_access = FALSE;
+      global $user;
+      foreach($user->roles as $role_id => $role_name) {
+        if (in_array($role_id, $allowed_roles)) {
+          $has_role_access = TRUE;
+          break;
+        }
+      }
+    }
+
     while($row = db_fetch_array($result)) {
       $node = node_load($row['nid']);
-      if (node_access('view', $node)) {
+      if (node_access('view', $node) && $has_role_access) {
         return; // Access is ok as far as we are concerned.
       }
     }
@@ -476,7 +499,20 @@
     '#options' => array ( 'private' => 'private', 'public' => 'public' ),
     '#description' => t('Are uploads public or private by default?'),
   );
-  
+
+  if (user_access('administer permissions')) {
+    $roles = user_roles();
+    if ($roles) {
+      $form['settings']['private_upload_roles'] = array(
+        '#type' => 'checkboxes',
+        '#title' => t('Roles allowed to download private files, no matter what the node access settings permit'),
+        '#options' => $roles,
+        '#default_value' => variable_get('private_upload_roles', array()),
+        '#description' => t('If no roles are selected, then the default behavior of using node access settings is used.'),
+      );
+    }
+  }
+ 
   // STATUS REPORT ***************************************************************
   
   $form['status'] = array(