Non-public media should only be visible to connected users.

src/pages/notepad.rkt

@@ -479,7 +479,7 @@
   (define direct-link (media-link 'get file))
   (define media (get-media-by-file file))
   (cond
-    ( media
+    ( (and media (or (media-public? media) connected-usr))
       ( (pages:template
           #:title (displayed-name (media-name media) (media-public? media))
           #:author (media-author media)
@@ -499,6 +499,9 @@
                 '())
               ))
        param))
+    ( media
+      ; Media exists, but is private => not authorized
+      (pages:notepad:error param 'unauthorized))
     ( #t
       (pages:notepad:error param 'not-found))))