I have a custom content type with an image and a file field, both of which are uploaded to the private file system.
How do I create a public url to the image that will check for user permissions so that anonymous users are prevented from being able to browse to the image?
This is the code I tried first:
$url = file_create_url($node->field_my_private_image[$node->language]['uri']);
It generates a url to
system/files/ but that url is visible to anonymous users and it isn't being restricted by user permissions.
I saw a security patch for drupal 7.13, but it was supposedly fixed and I'm using drupal 7.22.
Is there a built-in way to do this or do I need to implement some functions in my module to respond to special urls to access these files which will check permissions and then stream the file back to the browser?