Drupal file module is suggesting a simple way for adding a private directory since Drupal 7:
https://www.drupal.org/docs/7/core/modules/file/overview
The simple way to add a private directory for your files is to create a sub-directory under the public directory like:
sites/default/files/private
It is so easy to ignore it in contrib/custom module as many developers are used to checking the path in an old way, for example
$in_public_path = strpos(@drupal_realpath($file), drupal_realpath('public://')) === 0;
The File module overview should be updated and the documentation should emphasize that the private files directory needs to be located outside of the Drupal root or webroot folder and the "simple way" should be mentioned at the end of the document as the last resort if the recommended configuration is not possible.
It is not a good practice regarding Drupal security, we could also produce a status report warning message to "simple way" private files directory path. Since this simple change can help thousands of the site owners and developers to improve the awareness of "Drupal security"
Comments
Comment #2
cilefen commented