Problem with ms-files.php

Hello guys,

I have a WP Multisite protected by SimpleSAML and simplesamlphp-authentication plugin. Thing is, the medias are not protected since WP uses ms-files.php to serve the images and so on (kindda like a proxy)

So i added at the beginning of the ms-files.php a condition isAuthenticated and I serve an error message if the user is not authenticated, the image if he is. The weird thing is, when I request the image URL , typically blog.example.com/blog1/files/2013/08/test.php, the image still shows up, but when I slightly change the URL (making it a “wrong one”), I have my error message, the one that was supposed to show up when I was requesting the picture.

It looks like the ms-files.php is not called when I request an image, but it is when the URL is wrong (but still subject to the .htaccess rewrite rule).

What am I doing wrong ??