Problem setting a private directory
I'm using private upload on several sites and can confirm that this works.  So no need to file a bug issue.


  At this stage I imagined that these settings would cause an uploaded file to go inside the ../private directory. Nope, instead they go into public directory sites/default/files. Was my assumption wrong?


No. This is indeed what should have happened.

So just to make sure, I set up a site to your exact specifications. I.e. with Drupal root in /demo/drupal and the private directory in /demo/private  (where / is the Unix file system root).

I first tested it using the absolute path (i.e. /demo/private as the private upload directory).  That worked without a glitch.

I then re-tested it using the relative path to the same directory (i.e. ../private).  That also worked without a glitch.

I also noted that Drupal threw the following error if I tried to input a non-existing directory as the private upload directory:

Warning: mkdir(): Permission denied in drupal_mkdir()
 (line 2341 of /demo/drupal/includes/file.inc).
 The directory /demo/bogus does not exist and could not be created.


In other words: If Drupal allow you to use ../private as the private upload directory without throwing this error, your setup should work for private upload.  

Drupal will automatically place a .htaccess-file in the private upload directory to protect it against  prying eyes.  However, for best security, the private upload directory should be above the web-root.

PS: As for the file being "served merrily to an anonymous user", this will happen if the anonymous user is granted access to the node the privatly uploaded file it attached to.

All that the "private download method" does, is to extend Drupal's access control system so that files attached to nodes are made inaccesible to those who happen to know their URL.  It does so by pretending that the attachement is stored in the fictitious directory (system/files/).  Since this directory does not exist, bypassing Drupal by converting the path into an URL and requesting it directly from the web server will not work.

This is different from, and more secure than the "public download method". This method let those who know a file attachement URL bypass Drupal's access control.