[dev] [PATCH] Wholesome Linkage

[Chuck Hagenbuch]

Quoting Coleman <mercury at appisolutions.net>:

>> To do before the bounty can be paid:
>> * linked attachments need to work when uploaded attachments aren't already
>> stored in the VFS.
>
> So, if for example, the site configuration did not include a VFS, but had a
> plain directory instead? Or do you mean catching when some user wants to
> download a file not stored in VFS at all, like system passwd file or
> something?

The latter definitely, though at a glance your code did account for 
that. What I
was referring to is this set of code:

         foreach ($this->_cache as $att) {
             $trailer .= "\n" . Util::addParameter($baseurl, array('u' 
=> $auth,
                                                                   't' => $ts,
                                                                   'f' =>
$att->getName()));
             $vfs->rename(IMP_VFS_ATTACH_PATH,
$att->getInformation('temp_filename'), $fullpath,
escapeshellcmd($att->getName()));
         }

That $vfs->rename() call assumes that the attachment was copied into the VFS
when it was uploaded. If $conf['compose']['use_vfs'] is false, that won't be
the case. Or am I missing something?

-chuck

--
"Regard my poor demoralized mule!" - Juan Valdez