I have a file upload directory above root in a folder called "secure_files". I can successfully upload files to this directory from within my Assets field. The file upload directory is setup like below...
Server Path to Upload Directory: /Users/mlohrman/Sites/secure_files/
URL of Upload Directory: ../
here's my template code..."file_upload_matrix" is my matrix field. "files" is the column with the Assets field in it. This successfully displays the files on the front end.
{file_upload_matrix}
{filename}
{files}
<a href="{url}">{title}</a>
{/files}
{/file_upload_matrix}
The URL on the front-end is "../file.pdf". So when I'm on this page "http://site.com/departments/marketing/files/" it's trying to find the file at "http://site.com/departments/file.pdf".
Now I've done something similar using DevDemon Channel Files and had the same file upload settings and that plugin has a built in obfuscated links feature. I'm not sure what's happening behind the scenes, but setting the file URL to obfuscated would allow a person on the front-end to download that file that was sitting in the folder above root. I know Assets doesn't have the obfuscated link feature, but I thought I could try Link Vault plugin to do that for me. But I'm not positive the URL is correct now to pass to Link Vault. Any thoughts?