:-). It's not that smutty, actually shows how powerful the *NIX file model is. Anyway, the crucial thing about this is that you have an app (the web server) that still regulates access to the files, because the filesystem permissions are useless for that (the user needs permissions to access to the original file in order to access the link). Well, you can do really dirty tricks with directory permissions but that gets no fun really quickly.

BTW, you may want to use hard instead of soft links for files, because

1. You can move the original file around without invalidating the link
2. Deleting the original still leaves your user with access to the linked file, which can be reaped once his directory gets removed again. With hardlinks, an "rm" doesn't remove the file, it just removes one directory entry that points to it (of course, depending on your spec this may actually be a reason for you to go with soft links).