Private files aren't blocking direct access to image files I'm currently very confused by how private files work:


I have a content type that has an image field and a file field.  Both
are set up to use private file access for their contents.
Node access on the content type is working correctly.
A user who does not have access to the node cannot get to the contents of the file field -- they get an access_denied page when they try to load the URL of the file.
However, they DO have access to the image file, via the image's url (/system/files/...): hitting the image URL in a browser brings it right up.


Are there any insights out there about why the image file is leaking through, and what I can do to stop it?   I've explored hook_file_download and hook_file_download_access, and have been putting watchdog statements throughout the image and files modules trying to track this down, but to no avail.  Thanks!
There are three implementations of hook_file_download(), in Drupal:


file_file_download()
image_file_download()
user_file_download()


The first two implementations always check the user has access to the entity to which the file is associated; the third one doesn't check that, but it only checks the directory containing the file is the one used for the user profile's pictures.

function user_file_download($uri) {
  if (strpos(file_uri_target($uri), variable_get('user_picture_path', 'pictures') . '/picture-') === 0) {
    $info = image_get_info($uri);
    return array('Content-Type' =&gt; $info['mime_type']);
  }
}


If there isn't any other module implementing hook_file_download(), I would expect the users to be able to access the files through http://example.com/system/files when the URI points to the same directory containing the images used for the user accounts.