Help: Upgrade to 4.7.2 leaves images unaccessable. This issue has been reported but my questions further-on really concerns the best practice for uploading image files to Drupal stories, which falls under this forum topic!
I have just upgraded an existing site from Drupal 4.6.1 to 4.7.2
The problem I am experiencing stems from the following subjects and is identical to the issue that has been posted regarding SA_2006_006, but I have further questions.
http://drupal.org/files/sa-2006-006/advisory.txt
http://drupal.org/drupal-4.7.1
http://drupal.org/node/68685
The images in the directories under files are inaccessable due to the security .htaccess file that is created under files and is described in the above posts/issues. If I delete .htaccess, the next cron.php run seems to recreate it. My temporary, albeit very insecure, arrangement has been to leave the line "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006" and to comment the rest of the file, which needless to say nullifies the security.
This specific site is for an estate agent and I have created FTP access to the files/img directory where numerous images for every property are uploaded into files/img/2006x001 or files/img/2006x195 directories where the last digits of the directory scheme determines a property code. Those files are uploaded from an identical structure on the Estate Agent's PC via FTP and are not transferred through Drupal at all. Their file permissions are automatically set to full read/write + owner execute. Specifically, these are the files that have the problems with the new Drupal sa-2006-006. The relative URLs of the image files are all in the format of "files/img/2006x001/file_abc.jpg" and so on in the appropriate stories within Drupal. This particular estate agent prefers this scheme of storing images etc and up to now it has worked effectively. A certain period after the properties are sold, the complete image directories are deleted via FTP. The agent wants it that way since it is embarassing if the client that has recently purchased a home believes that the estate agent is trying to sell the house again via the Internet! There is a taxonomy catagory determining "for sale" / "sold" / "purged" that controls (via PHP snippets) what type of property appears in what catagory of property listing. Stories in the catagory 'purged' are periodically deleted entirely, since the Google Sitemap module still produces links for all pages though they are not necessarily accessible from the site navigational structure. My long-term goal is to replace this structure via something developed in CCK (one day when CCK becomes really stable, commonplace, well documented etc), but for now the existing arrangement actually works very effectively. (This is an ultra-low-budget effort, but Drupal has done an absolutely sterling job so far!)