If I create a new folder under Portal Root in my site and only allow one role access to the folder.  If I upload an image to the folder, I can still access it with a URL  domain/portals/0/Folder/image.png 

Is this not what the security was intended to do ?  How do I protect the contents of the folder only for specific roles?

If I do this, I then have to upload everything through the file manager?

I have root access to my server, I wanted to add a subdirectory under my Portal/0/ root like:

Portal/0/

Dir1/Mainpage.html

Dir1/FlashVideo.swf

where my flash video is referenced by the mainpage.html..  If I store these files in the secure file system wont the html page no longer be able to see the swf file sitting in the same folder as it is..  doesn't everything have to come out of dnn with File Tokens after storing in a secure file system?

As I had feared...

My .html page hosts the FlashMovie.swf file, which it now can't find because it's stored in the secure filesystem.  This works fine not in the secured file system.. I guess my only other option is to provide authentication in a subdomain and to use active directory to secure it by user?

Webpage error details

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30618; yie8)
Timestamp: Fri, 5 Jun 2009 03:29:19 UTC

Message: 'swfobject' is undefined
Line: 26
Char: 13
Code: 0
 

<div id="media">
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="1024" height="786" id="csSWF">
<param name="movie" value="FlashMovie.swf" />
<param name="quality" value="best" />
<param name="bgcolor" value="#1a1a1a" />
<param name="allowfullscreen" value="true" />
<param name="scale" value="showall" />
<param name="allowscriptaccess" value="always" />
<param name="flashvars" value="autostart=false&showendscreen=false&color=0xFFFFFF,0xFFFFFF" />
<!--[if !IE]>-->
<object type="application/x-shockwave-flash" data="FlashMovie.swf" width="1024" height="786">
<param name="quality" value="best" />
<param name="bgcolor" value="#1a1a1a" />
<param name="allowfullscreen" value="true" />
<param name="scale" value="showall" />
<param name="allowscriptaccess" value="always" />
<param name="flashvars" value="autostart=false&showendscreen=false&color=0xFFFFFF,0xFFFFFF" />
<!--<![endif]-->
<div id="noUpdate">
</div>
<!--[if !IE]>-->
</object>
<!--<![endif]-->
</object>
</div>