I just had to look into a problem with a book module where an uploaded movie file was not available to students, however it was available to users in the system with higher roles.
With our courses, student cohorts get their own instance of a course in each study period, which requires courses to be cloned from study period to study period (works fine, generally).
The root cause was that the media that was inaccessible was uploaded to the book as part of course ID 345 (specific ID not important) then at the end of the study period that course was then copied using the moodle web-service to course ID 678 (again the specific ID isn't important). The content of the book was included in the copy/clone, but it was using the previous courses details through the m_files table, the m_context table and into m_course_modules.
My understanding of the "new" moodle data file system structure and concepts were that new links to this media should be created directly to the content when the activity was cloned, rather than simply copying the old link. Students in course id 678 have no rights to view content added to course 345, so this is why the link is inaccessible at this point to the students.
Is this a bug or has something else happened?
Happy to raise a tracker issue if this is believed to be a bug.