• Do not register here on develop.twiki.org, login with your twiki.org account.
• Use View topic Item7848 for generic doc work for TWiki-6.1.1. Use View topic Item7851 for doc work on extensions that are not part of a release. More... Close
• Anything you create or change in standard webs (Main, TWiki, Sandbox etc) will be automatically reverted on every SVN update.
Does this site look broken?. Use the LitterTray web for test cases.

Item4222: users may accidentally delete topic instead of attachment due to lost URL param

Item Form Data

AppliesTo: Component: Priority: CurrentState: WaitingFor: TargetRelease ReleasedIn
Extension NatSkin Normal Confirmed   n/a  

Edit Form Data

Reported By:
Applies To:
Current State:
Waiting For:
Target Release:
Released In:


If you're trying to move an attachment as TWikiGuest TWiki (NatSkin) asks you to login.

Afterwards the ?attachment=myfile.doc parameter is lost. So instead of page based on moveattachment.nat.tmpl TWiki (NatSkin) loads a page that is based on renamebase.nat.tmpl.

Users who do not recognize this can accidentally move the entire topic to the trash web instead of just the attachment.

Here's a work around (requires SpreadSheetPlugin): in line 6 in attachtables.nat.tmpl change

<a href="%SCRIPTURLPATH{"attach"}%/%WEB%/%TOPIC%?filename=%A_FILE%&revInfo=1" title='%MAKETEXT{"manage properties of [_1]" args="<nop>%A_FILE%"}%' rel='nofollow'>%MAKETEXT{"props"}%</a>, <a href="%SCRIPTURLPATH{"rename"}%/%WEB%/%TOPIC%?attachment=%A_FILE%" title='%MAKETEXT{"move or delete [_1]" args="<nop>%A_FILE%"}%' rel='nofollow'>%MAKETEXT{"move"}%</a>
%CALC{$IF($EXACT(%WIKINAME%,TWikiGuest),<a href='%NATLOGINURL%' rel='nofollow' accesskey='l' title='TWiki Login'>login</a> required, <a href='%SCRIPTURLPATH{"attach"}%/%WEB%/%TOPIC%?filename=%A_FILE%&revInfo=1' title='%MAKETEXT{"manage properties of [_1]" args="<nop>%A_FILE%"}%' rel='nofollow'>%MAKETEXT{"props"}%</a>, <a href='%SCRIPTURLPATH{"rename"}%/%WEB%/%TOPIC%?attachment=%A_FILE%' title='%MAKETEXT{"move or delete [_1]" args="<nop>%A_FILE%"}%' rel='nofollow'>%MAKETEXT{"move"}%</a>)}%

-- TWiki:Main/CarloSchulz - 07 Jun 2007

Carlo, thanks a lot for catching this. However I will work around this issue by hiding the attachment actions if the current user has no access rights to the topic. This may also be the case if you are authenticated but forbidden by some ACLs. The tools to do this are in the IfDefinedPlugin, using the %IFACCESS tag...

-- TWiki:Main.MichaelDaum - 08 Jun 2007

Summary users may accidentally delete topic instead of attachment due to lost URL param
ReportedBy TWiki:Main.CarloSchulz
Codebase 4.1.2
SVN Range TWiki-4.1.2, Mon, 04 Jun 2007, build 14028
AppliesTo Extension
Component NatSkin
Priority Normal
CurrentState Confirmed


TargetRelease n/a

Edit | Attach | Watch | Print version | History: r2 < r1 | Backlinks | Raw View |  Raw edit | More topic actions
Topic revision: r2 - 2007-06-08 - TWikiUserMapping_MichaelDaum
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2008-2023 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback