Index: modules/system/system.install
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.install,v
retrieving revision 1.510
diff -u -p -r1.510 system.install
--- modules/system/system.install	1 Oct 2010 18:37:23 -0000	1.510
+++ modules/system/system.install	3 Oct 2010 20:16:15 -0000
@@ -267,20 +267,19 @@ function system_requirements($phase) {
 
   // Test files directories.
   $directories = array(
-    variable_get('file_public_path', conf_path() . '/files'),
-    // By default no private files directory is configured. For private files
-    // to be secure the admin needs to provide a path outside the webroot.
-    variable_get('file_private_path', FALSE),
+    'public' => variable_get('file_public_path', conf_path() . '/files'),
+    // By default no private files directory is configured.
+    'private' => variable_get('file_private_path', FALSE),
   );
 
   // Do not check for the temporary files directory at install time
   // unless it has been set in settings.php. In this case the user has
   // no alternative but to fix the directory if it is not writable.
   if ($phase == 'install') {
-    $directories[] = variable_get('file_temporary_path', FALSE);
+    $directories['temp'] = variable_get('file_temporary_path', FALSE);
   }
   else {
-    $directories[] = variable_get('file_temporary_path', file_directory_temp());
+    $directories['temp'] = variable_get('file_temporary_path', file_directory_temp());
   }
 
   $requirements['file system'] = array(
@@ -288,17 +287,18 @@ function system_requirements($phase) {
   );
 
   $error = '';
+  $is_writable = array();
   // For installer, create the directories if possible.
-  foreach ($directories as $directory) {
+  foreach ($directories as $directory_type => $directory) {
     if (!$directory) {
       continue;
     }
     if ($phase == 'install') {
       file_prepare_directory($directory, FILE_CREATE_DIRECTORY);
     }
-    $is_writable = is_writable($directory);
+    $is_writable[$directory_type] = is_writable($directory);
     $is_directory = is_dir($directory);
-    if (!$is_writable || !$is_directory) {
+    if (!$is_writable[$directory_type] || !$is_directory) {
       $description = '';
       $requirements['file system']['value'] = $t('Not writable');
       if (!$is_directory) {
@@ -329,6 +329,31 @@ function system_requirements($phase) {
       else {
         $requirements['file system']['value'] = $t('Writable (<em>private</em> download method)');
       }
+      $is_writable[$directory_type] = TRUE;
+    }
+  }
+
+  // Ensure that a private directory is protected (if we know it's writable).
+  // We also need a writable temporary directory for this test to work.
+  if ($phase == 'runtime' && !empty($is_writable['private']) && !empty($is_writable['temp'])) {
+    $private_directory = $directories['private'];
+    $test_file = file_unmanaged_save_data("This is a file to test private download security, and can be safely removed.\n", "private://DRUPAL_PRIVATE_FILES_TEST.txt");
+    if (!empty($test_file)) {
+      $requirements['file_system_private_secure'] = array(
+        'title' => $t('File system private directory'),
+      );
+
+      $http_result = drupal_http_request(url($base_url . '/' . $private_directory . substr($test_file, 9)));
+      if (!isset($http_result->error)) {
+        $requirements['file_system_private_secure']['description'] = $t('The private files in %directory appear to be publicly accessible. To ensure that the directory is not directly accessible either move it outside of your website root (and change the path at the <a href="@admin-file-system">file system settings page</a>) or configure your web server to block access to the directory.', array('%directory' => $private_directory, '@admin-file-system' => url('admin/config/media/file-system')));
+        $requirements['file_system_private_secure']['severity'] = REQUIREMENT_WARNING;
+        $requirements['file_system_private_secure']['value'] = $t('Check configuration');
+      }
+      else {
+        $requirements['file_system_private_secure']['value'] = $t('%directory does not appear to be directly accessible from the web.', array('%directory' => $private_directory));
+        $requirements['file_system_private_secure']['description'] = $t('It is important to manually verify that the directory is protected due to the differences in web server configuration.');
+      }
+      file_unmanaged_delete($test_file);
     }
   }