I am currently working on a small Drupal contract and part of the work is to allow files to be attached to content that only a particular user can see (User A); the trick is that the person uploading the files (User B) isn't the person that should be allowed to see them.
This technique requires a few settings and modules to work.
Setup Drupal to serve files privately, not through HTTP in admin/settings/file-system
Ensure you have the following modules installed and enabled: CCK, FileField (a CCK file field), ACL (access control lists) and Content Access.
Create a new CCK content type and in the Access Control tab enable "Enable per node access control settings" for that content type
Enable "administer access control" for the user/role of the person uploading the files
Create a new node using the CCK content type and once published change the access permissions on the node to allow only User A to see the files.
Done!
This seems to be working so far but I have more testing to do.
