Index: modules/system/system.install
===================================================================
RCS file: /Users/wright/drupal/local_repo/drupal/modules/system/system.install,v
retrieving revision 1.510
diff -u -p -r1.510 system.install
--- modules/system/system.install	1 Oct 2010 18:37:23 -0000	1.510
+++ modules/system/system.install	2 Oct 2010 18:43:31 -0000
@@ -267,20 +267,19 @@ function system_requirements($phase) {
 
   // Test files directories.
   $directories = array(
-    variable_get('file_public_path', conf_path() . '/files'),
-    // By default no private files directory is configured. For private files
-    // to be secure the admin needs to provide a path outside the webroot.
-    variable_get('file_private_path', FALSE),
+    'public' => variable_get('file_public_path', conf_path() . '/files'),
+    // By default no private files directory is configured.
+    'private' => variable_get('file_private_path', FALSE),
   );
 
   // Do not check for the temporary files directory at install time
   // unless it has been set in settings.php. In this case the user has
   // no alternative but to fix the directory if it is not writable.
   if ($phase == 'install') {
-    $directories[] = variable_get('file_temporary_path', FALSE);
+    $directories['temp'] = variable_get('file_temporary_path', FALSE);
   }
   else {
-    $directories[] = variable_get('file_temporary_path', file_directory_temp());
+    $directories['temp'] = variable_get('file_temporary_path', file_directory_temp());
   }
 
   $requirements['file system'] = array(
@@ -288,8 +287,9 @@ function system_requirements($phase) {
   );
 
   $error = '';
+  $private_directory_writable = FALSE;
   // For installer, create the directories if possible.
-  foreach ($directories as $directory) {
+  foreach ($directories as $directory_type => $directory) {
     if (!$directory) {
       continue;
     }
@@ -329,6 +329,31 @@ function system_requirements($phase) {
       else {
         $requirements['file system']['value'] = $t('Writable (<em>private</em> download method)');
       }
+      if ($directory_type == 'private') {
+        $private_directory_writable = TRUE;
+      }
+    }
+  }
+
+  // Ensure that a private directory is protected (if we know it's writable).
+  if ($phase == 'runtime' && $private_directory_writable) {
+    $private_directory = variable_get('file_private_path', FALSE);
+    if ($private_directory) {
+      $requirements['file_system_private_secure'] = array(
+        'title' => $t('File system private directory'),
+      );
+
+      $test_file = file_unmanaged_save_data("This is a file to test private download security, and can be safely removed.\n", "private://DRUPAL_PRIVATE_FILES_TEST.txt");
+      $http_result = drupal_http_request(url($base_url . '/' . $private_directory . substr($test_file, 9)));
+      if (!isset($http_result->error)) {
+        $requirements['file_system_private_secure']['description'] = $t('The private files in %directory are publicly accessible. To ensure that the directory is not directly accessible either move it outside of your website root (and change the path at the <a href="@admin-file-system">file system settings page</a>) or configure your web server to block access to the directory.', array('%directory' => $private_directory, '@admin-file-system' => url('admin/config/media/file-system')));
+        $requirements['file_system_private_secure']['severity'] = REQUIREMENT_ERROR;
+        $requirements['file_system_private_secure']['value'] = $t('Not secure');
+      }
+      else {
+        $requirements['file_system_private_secure']['value'] = $t('%directory is not directly accessible from the web.', array('%directory' => $private_directory));
+      }
+      file_unmanaged_delete($test_file);
     }
   }