closes #2295

src/routes/index.js

@@ -149,6 +149,16 @@ module.exports = function(app, middleware) {
 		require('./debug')(app, middleware, controllers);
 	}
 
+	app.use(function(req, res, next) {
+		if (req.user || parseInt(meta.config.privateUploads, 10) !== 1) {
+			return next();
+		}
+		if (req.path.indexOf('/uploads/files') === 0) {
+			return res.status(403).json('not-allowed');
+		}
+		next();
+	});
+
 	app.use(relativePath, express.static(path.join(__dirname, '../../', 'public'), {
 		maxAge: app.enabled('cache') ? 5184000000 : 0
 	}));

src/views/admin/settings/post.tpl

@@ -45,6 +45,11 @@
 					<input type="checkbox" data-field="allowFileUploads"> <strong>Allow users to upload regular files</strong>
 				</label>
 			</div>
+			<div class="checkbox">
+				<label>
+					<input type="checkbox" data-field="privateUploads"> <strong>Make uploaded files private</strong>
+				</label>
+			</div>
 			<strong>Maximum File Size</strong><br /> <input type="text" class="form-control" value="2048" data-field="maximumFileSize"><br />
 
 			<div class="checkbox">