I have found that the same type of code (checking the given path) occurs in the 'getfile.php' file too. This seems to be called when downloading media. In our case I have modified this file too (diff patch attached), and downloads are now working as expected.