I know that the file system is very hard to move from the root of drupal once your site is mature, but I have tried it anyway (not on my live site, but on a clone of it). I have tried to read also as much as I could about this both in the drupal.org search and doing a general google search.
So I'm telling the list what I did and what didn't work, just in case anybody can give me any hints to understand a little bit better how things work with the file system.
My site is Drupal 5.7. I have full access to the server, database, you name it (it must be almost impossible to do this without full access). Server is linux with standard tools.
My previous setup was file system set to "private" but located in the root of drupal, in a "files" directory.
So I created a directory out of the webserver root and put my "files" directory there, with write permissions and owned by apache owner and group. Then I changed the path in admin/settings/file-system to the new path, and erased my old "files" directory at the root.
I use fckeditor to upload files and images to nodes, so these get an initial path of "/files/file" and "/files/image". Now these paths have to be moved to "/system/files/file" and "/system/files/image" once the files are out of the root. I changed this searching for all tables which contained these strings with the "search" feature of phpmyadmin, and then substituting the strings with the mysql command line (UPDATE table SET column = REPLACE(filepath,"/files/file", "/system/files/file");) I tried this of course on a sandbox install and database, and will get all the backups if I try to mess around with my actual database. There are not so many tables that contain references to files, so this can be done in about half an hour.
In any case, after adjusting a couple more things related to fckeditor seeing the new file system, everything seemed to work until I logged out. The anonymous user was unable to access the files in the new file system. Also strangely some roles could access them but some others could not, and in particular I have two roles which look very similar in terms of permissions but one can access it and the other not. I also tried giving the remaining permissions to the role whith no access, but no result, no matter what I tried.
So now I have a lot of questions: 1) is the "private" file system outside of the root always inaccessible for anonymous users? 2) Which is the permission that gives access to this type of private file system? 3) What is the effect of having "private" chosen, but the file system in the root? This seems to give access to everybody to the files and images that are referred in nodes, despite the fact of setting it as "private". 4) And how come I have such a disparate behavior of different roles, what determines which ones can access the outside private file system?
Thanks for any hints on this.