Index: modules/upload/upload.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/upload/upload.module,v
retrieving revision 1.200
diff -u -p -r1.200 upload.module
--- modules/upload/upload.module	14 Apr 2008 17:48:43 -0000	1.200
+++ modules/upload/upload.module	29 Apr 2008 21:19:17 -0000
@@ -147,13 +147,13 @@ function _upload_file_limits($user) {
 /**
  * Implementation of hook_file_download().
  */
-function upload_file_download($file) {
-  if (!user_access('view uploaded files')) {
-    return -1;
-  }
-  $file = file_create_path($file);
+function upload_file_download($filepath) {
+  $filepath = file_create_path($filepath);
   $result = db_query("SELECT f.* FROM {files} f INNER JOIN {upload} u ON f.fid = u.fid WHERE filepath = '%s'", $file);
   if ($file = db_fetch_object($result)) {
+    if (!user_access('view uploaded files')) {
+      return -1;
+    }
     return array(
       'Content-Type: ' . $file->filemime,
       'Content-Length: ' . $file->filesize,