--- upload.module.1	2005-01-10 22:06:16.000000000 +0100
+++ upload.module	2005-01-10 22:00:05.000000000 +0100
@@ -90,7 +90,7 @@ function upload_download() {
 function upload_file_download($file) {
   if (user_access('view uploaded files')) {
     $file = file_create_path($file);
-    $result = db_query("SELECT * from {files} n " . node_access_join_sql() . " WHERE filepath = '%s' AND ". node_access_where_sql(), $file);
+    $result = db_query(node_rewrite_sql("SELECT f.nid, * from {files} f WHERE filepath = '%s", 'f'), $file);
     if ($file = db_fetch_object($result)) {
       $name = mime_header_encode($file->filename);
       // Serve images and text inline for the browser to display rather than download.