First I assumed it was an error in the file system, but I found out out that problem is only occurs with image nodes.

Initially issue:
http://drupal.org/node/141109

Comments

toniw’s picture

toniw commented

I find this a serious issue too.
I have all my images in a private folder, not accessible from the webserver's root, anonymous users are configured to have no access to the node of an image, but the image itself is perfectly retrievable via
http://somehost/?q=system/files/images/imgname.jpg

Stefan Nagtegaal’s picture

Stefan Nagtegaal commented

I'm not sure, but shouldn't this be addressed in core, and overridable by some _hook? or _alter()?

drewish’s picture

drewish commented
Status: Active » Closed (duplicate)

i think it's a shortcoming in the image module, there's another issue for it (in addition to this guys duplicates). i'm marking this as a duplicate of http://drupal.org/node/141302