Index: modules/system/system.install
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.install,v
retrieving revision 1.510
diff -u -p -r1.510 system.install
--- modules/system/system.install	1 Oct 2010 18:37:23 -0000	1.510
+++ modules/system/system.install	3 Oct 2010 19:58:44 -0000
@@ -267,20 +267,19 @@ function system_requirements($phase) {
 
   // Test files directories.
   $directories = array(
-    variable_get('file_public_path', conf_path() . '/files'),
-    // By default no private files directory is configured. For private files
-    // to be secure the admin needs to provide a path outside the webroot.
-    variable_get('file_private_path', FALSE),
+    'public' => variable_get('file_public_path', conf_path() . '/files'),
+    // By default no private files directory is configured.
+    'private' => variable_get('file_private_path', FALSE),
   );
 
   // Do not check for the temporary files directory at install time
   // unless it has been set in settings.php. In this case the user has
   // no alternative but to fix the directory if it is not writable.
   if ($phase == 'install') {
-    $directories[] = variable_get('file_temporary_path', FALSE);
+    $directories['temp'] = variable_get('file_temporary_path', FALSE);
   }
   else {
-    $directories[] = variable_get('file_temporary_path', file_directory_temp());
+    $directories['temp'] = variable_get('file_temporary_path', file_directory_temp());
   }
 
   $requirements['file system'] = array(
@@ -288,17 +287,18 @@ function system_requirements($phase) {
   );
 
   $error = '';
+  $is_writable = array();
   // For installer, create the directories if possible.
-  foreach ($directories as $directory) {
+  foreach ($directories as $directory_type => $directory) {
     if (!$directory) {
       continue;
     }
     if ($phase == 'install') {
       file_prepare_directory($directory, FILE_CREATE_DIRECTORY);
     }
-    $is_writable = is_writable($directory);
+    $is_writable[$directory_type] = is_writable($directory);
     $is_directory = is_dir($directory);
-    if (!$is_writable || !$is_directory) {
+    if (!$is_writable[$directory_type] || !$is_directory) {
       $description = '';
       $requirements['file system']['value'] = $t('Not writable');
       if (!$is_directory) {
@@ -329,6 +329,30 @@ function system_requirements($phase) {
       else {
         $requirements['file system']['value'] = $t('Writable (<em>private</em> download method)');
       }
+      $is_writable[$directory_type] = TRUE;
+    }
+  }
+
+  // Ensure that a private directory is protected (if we know it's writable).
+  // We also need a writable temporary directory for this test to work.
+  if ($phase == 'runtime' && !empty($is_writable['private']) && !empty($is_writable['temp'])) {
+    $private_directory = $directories['private'];
+    $test_file = file_unmanaged_save_data("This is a file to test private download security, and can be safely removed.\n", "private://DRUPAL_PRIVATE_FILES_TEST.txt");
+    if (!empty($test_file)) {
+      $requirements['file_system_private_secure'] = array(
+        'title' => $t('File system private directory'),
+      );
+
+      $http_result = drupal_http_request(url($base_url . '/' . $private_directory . substr($test_file, 9)));
+      if (!isset($http_result->error)) {
+        $requirements['file_system_private_secure']['description'] = $t('The private files in %directory appear to be publicly accessible. To ensure that the directory is not directly accessible either move it outside of your website root (and change the path at the <a href="@admin-file-system">file system settings page</a>) or configure your web server to block access to the directory.', array('%directory' => $private_directory, '@admin-file-system' => url('admin/config/media/file-system')));
+        $requirements['file_system_private_secure']['severity'] = REQUIREMENT_WARNING;
+        $requirements['file_system_private_secure']['value'] = $t('Check configuration');
+      }
+      else {
+        $requirements['file_system_private_secure']['value'] = $t('%directory does not appear to be directly accessible from the web. It is important to verify that the directory is protected manually due to the differences in web server configuration.', array('%directory' => $private_directory));
+      }
+      file_unmanaged_delete($test_file);
     }
   }