I'm currently very confused by how private files work:
- I have a content type that has an image field and a file field. Both are set up to use private file access for their contents.
- Node access on the content type is working correctly.
- A user who does not have access to the node cannot get to the contents of the file field -- they get an access_denied page when they try to load the URL of the file.
- However, they DO have access to the image file, via the image's url (/system/files/...): hitting the image URL in a browser brings it right up.
Are there any insights out there about why the image file is leaking through, and what I can do to stop it? I've explored hook_file_download and hook_file_download_access, and have been putting watchdog statements throughout the image and files modules trying to track this down, but to no avail. Thanks!