Bug: viewfile does not check permissions

AFAICT the shipped viewfile script does not check permissions. This means that a footpad who knew the name of an attachment to a secured topic can access it. Worse, if the filename parameter is not passed, the footpad can get a listing of the pub directory for that topic.

-- CrawfordCurrie - 03 Dec 2004

Fixed in Dakar.