I have a managed package that includes a css file that I want to allow the user to be able to modify, in order to change the styling of my visualforce page, when they host it on their website through Sites.

Originally, I made my css file a static resource, but found that it was locked down in a managed package.  So I then came up with the following hack...

in my controller class:

    // the instance specific url to the css that can be modified by the user.
    public string strURLtoCSSFile {
        get {
            if (strURLtoCSSFile == null) {
                list<Document> listDocs = [SELECT Name, Id From Document WHERE Name = 'MyCSS.css' LIMIT 1 ];
                if (listDocs.size() > 0) {
                    Document doc = listDocs[0];
                    string imageid = doc.id;
                    imageid = imageid.substring(0,15);
                    strURLToCSSFile = '/servlet/servlet.FileDownload?file=' + imageid;
                }
            }
            return strURLtoCSSFile;
        }        
        set;
    } 

in my visualforce page:

  <apex:stylesheet value="{!strURLtoCSSFile}" />

This seemed to work great when testing the visualforce page directly.  But when the visualforce page was being surfaced through Sites, I found that I had to enable Read permissions on the Documents standard object in the Site's Public Access Settings.

Unfortunately, this seems to open up all documents as readable to the Site.  I found no way to set this either per directory or per actual file.

Any ideas on how to correctly set the permissions, or a better way to do this?

Thanks!

Dave