I have a question that I thought the below thread would provide the answer to, but things in WP have changed so it doesn't quite do it, although it helped my understanding of things.
Basically, I would like to not serve files that are attached to private posts unless the user is actually logged in. That apparently requires that all request go through a php file that basically does what the ms-files code die before it was removed from WP multisite in 3.5 (as I found out). The first approach in this answer
apprently still works for single site installations but as the rewrite code and the file structure for multisite have changed, the modifications in the first thread I linked to no longer work.
Frank Bueltge's approach (the second answer in the thread) even incorporates a check for the attachment's parent (and would thus allow a check for post_status) but somehow I can't get it to work. And somehow, the modified code he includes in his plugin "authenticator" also don't seem to work.
I understand that serving files through php is bad for performance, but as far as I understand, this is the only way a login-check/status-check can be logically done. Sadly, I can't seem to get any of the solutations to work for a multisite installation, given the changes since the removal of ms-files.php.
I'd really appreciate any help! Thanks a lot!