Having trouble understanding private files in Drupal 7 I'm trying to set up private files on Drupal 7 using Organic Groups. So far, I have

(1) one group type that although I appear to have set it up as such 


  


(2) have private files set up in as below. (The webroot is /var/www/html.) 


  


(3) Ensured the link on the OG's page is /system/files/test.example.doc, 


  


(4) I inspected the database entry and this appears to be good. 

MariaDB [s7data]&gt; select * from file_managed \G

*************************** XXX. row ***************************
      fid: 357
      uid: 103
 filename: test.pwww_.doc
      uri: private://test.pwww_.doc
 filemime: application/msword
 filesize: 9
   status: 1
timestamp: 1460390385
     uuid: 3a9877fc-77b2-47bc-8d4f-e8bc349f4c74


I am still able, using this link path do download that doc in a new browser without being logged in. In effect, this file is not private and does not require an authenticated session to download. 

Question: Did I miss something? How does one set up private files correctly on Drupal 7?
Whenever possible it's recommended that you choose a directory located
  outside of your Drupal root folder (or actually outside your web
  root), which may be tricky if you are on a shared host. If you do have
  access though, you can choose a private directory which will be on the
  same level as your web root directory (often called public_html or www
  or similar).


From Working with files in Drupal 7 and Drupal 8.

The best practice is to place your private files outside of your webroot, so they should not be inside /var/www as that would make them accessible over the web. Place them in /var/somefolder instead, make sure your webserver has read write access to that folder. After that you should only be able to access them via /system/files/test.example.doc and it should not work for anonymous users.

UPDATE:

Above is based on the assumption you were accessing the file via example.com/drupal-private-file-system/test.example.doc. this can be prevented by using the linked best practise guide.

If an anonymous user can access your files with on url like example.com/system/files/test.example.doc you have a problem with your permissions and anonymous users are given the permission to download private files.