Default upload scheme ignored when ‘skip scheme selection’ is selected

Hi all,

After updating from FE 2.2 to 2.3 I noticed that the default upload scheme is ignored when 'skip scheme selection' is selected in the module configuration.

This means that when the default scheme is set to private:// files get uploaded to the public file directory without notifying the user in any way. This seems like a pretty serious security issue to me!

*I think this issue may have to do with https://www.drupal.org/node/2264145 that was committed to FE 2.3, but I am not sure.

Steps to reproduce:

1. make sure you have set the default upload scheme to private:// at 'admin/config/media/file-system'.
2. upload a file at 'file/add'
3. check the file destination at 'file/xxx/edit' , the destination is now set to 'Public files' while it should be set to 'Private files'.

I added screenshots that should clarify the steps to reproduce above.

It should be noted that the behaviour described above does not occur when 'skip scheme selection' is not selected at the module configuration page. When acceptable this could serve as a workaround for the problem, but in cases where this is simply not acceptable from a UI perspective this remains a problem to be solved.

Especially the silent nature of this behaviour creates a security threat in my view. Users expect files to be uploaded to the private destination while files are uploaded to the public destination without any notification...

If anyone has suggestions for how to solve this, please let me know!

Cheers,
Marco